CVEvulnerability
CVE-2015-8807
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-04-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.
Affected configurations
• fedoraproject fedora 22
• fedoraproject fedora 23
• horde groupware 5.2.11
• debian debian linux 8.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.html lists.fedoraproject.org
- http://lists.horde.org/archives/announce/2016/001148.html Vendor Advisory
- http://lists.horde.org/archives/announce/2016/001149.html Vendor Advisory
- http://www.debian.org/security/2016/dsa-3496 www.debian.org
- http://www.openwall.com/lists/oss-security/2016/02/06/4 www.openwall.com
- http://www.openwall.com/lists/oss-security/2016/02/06/5 www.openwall.com
- https://github.com/horde/horde/blob/e838d4c800b0d1ecaf8b4cc613fd3af4f994c79c/bundles/webmail/docs/CHANGES Exploit
- https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253 github.com
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.html lists.fedoraproject.org
- http://lists.horde.org/archives/announce/2016/001148.html Vendor Advisory
- http://lists.horde.org/archives/announce/2016/001149.html Vendor Advisory
- http://www.debian.org/security/2016/dsa-3496 www.debian.org
- http://www.openwall.com/lists/oss-security/2016/02/06/4 www.openwall.com
- http://www.openwall.com/lists/oss-security/2016/02/06/5 www.openwall.com
- https://github.com/horde/horde/blob/e838d4c800b0d1ecaf8b4cc613fd3af4f994c79c/bundles/webmail/docs/CHANGES Exploit
- https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253 github.com