CVE-2017-16906 In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar -> New Event" action.
MediumCVSS 5.4
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar -> New Event" action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/php-horde-kronolith(Debian:12) | < 4.2.24-1 | 4.2.24-1 |
| horde groupware | >= 5.2.19, <= 5.2.22 | No fix listed |
References
- Debian Security Tracker CVE-2017-16906 vendor-advisory
- code610.blogspot.com exploit issue-tracking third-party-advisory
- github.com patch third-party-advisory
- github.com exploit third-party-advisory
- [debian-lts-announce] 20200829 [SECURITY] [DLA 2351-1] php-horde-kronolith security update mailing-list
- bugs.debian.org issue-tracking