PT-2019-12636 · Horde+1 · Horde Groupware Webmail Edition+1

Publicado

2019-10-24

·

Atualizado

2019-12-03

·

CVE-2019-12094

CVSS v3.1

6.1

Média

VetorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Horde Groupware Webmail Edition versions prior to 5.2.23
Description The issue allows for XSS attacks via specific URI parameters. This can be achieved through the admin/user.php endpoint with either the form=update f or form=remove f parameter and the user name variable, or through the admin/config/diff.php endpoint with the app variable.
Recommendations For Horde Groupware Webmail Edition versions prior to 5.2.23, update to version 5.2.23 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/user.php and admin/config/diff.php endpoints until the update is applied. Avoid using the user name variable in the affected admin/user.php endpoint and the app variable in the admin/config/diff.php endpoint until the issue is resolved.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-12094

Produtos afetados

Debian
Horde Groupware Webmail Edition