CVE-2017-16907 In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action.
MediumCVSS 5.4
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/php-horde(Debian:12) | < 5.2.18+debian0-1 | 5.2.18+debian0-1 |
| debian/php-horde-core(Debian:12) | < 2.31.3+debian0-1 | 2.31.3+debian0-1 |
| debian/php-horde-core(Debian:12) | = 1.8.3-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 1.8.3-1.1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.0.4-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.1-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.3-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.4-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.4-2 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.5-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.10.1-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.10.2-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.11.1+dfsg0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.11.1-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.11.1-2 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.4.3-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.5.0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.6.0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.6.6-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.7.0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.8.0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.9.0-1 | No fix listed |
| horde groupware | = 5.2.19 | No fix listed |
| horde groupware | = 5.2.21 | No fix listed |
References
- Debian Security Tracker CVE-2017-16907 vendor-advisory
- code610.blogspot.com exploit issue-tracking third-party-advisory
- github.com patch third-party-advisory
- [debian-lts-announce] 20200829 [SECURITY] [DLA 2349-1] php-horde security update mailing-list
- [debian-lts-announce] 20200829 [SECURITY] [DLA 2348-1] php-horde-core security update mailing-list
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking