CVEvulnerability
CVE-2016-5303
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-12-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.
Affected configurations
• horde groupware 5.2.15
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://marc.info/?l=horde-announce&m=147319066126665&w=2 Release Notes, Third Party Advisory
- http://marc.info/?l=horde-announce&m=147319089526753&w=2 Release Notes, Third Party Advisory
- http://www.securityfocus.com/bid/94997 www.securityfocus.com
- https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97 Patch, Vendor Advisory
- https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424 Patch, Vendor Advisory
- http://marc.info/?l=horde-announce&m=147319066126665&w=2 Release Notes, Third Party Advisory
- http://marc.info/?l=horde-announce&m=147319089526753&w=2 Release Notes, Third Party Advisory
- http://www.securityfocus.com/bid/94997 www.securityfocus.com
- https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97 Patch, Vendor Advisory
- https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424 Patch, Vendor Advisory