PT-2020-19931 · Gollem · Gollem

Published 2020-05-18 · Updated 2020-05-31 · CVE-2020-8034

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gollem versions prior to 3.0.13

Description The issue is related to a reflected Cross-Site Scripting (XSS) vulnerability. It occurs via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can exploit this by making a victim visit a malicious URL, potentially obtaining access to the victim's webmail account.

Recommendations For versions prior to 3.0.13, update to version 3.0.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the browser functionality until a patch is applied. Avoid using the dir parameter in the affected HTTP GET requests until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-8034

DLA-2229-1

Affected Products

Gollem

References · 14

• https://github.com/horde/gollem/commits/master · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-8034 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8034 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8034 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8034 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-8034 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-8034 · Vendor Advisory
• https://lists.horde.org/archives/announce/2020/001289.html · Vendor Advisory
• https://lists.horde.org/archives/gollem/Week-of-Mon-20200420/001990.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2229-1 · Vendor Advisory
• https://github.com/horde/gollem/blob/95b2a4212d734f1b27aaa7a221d2fa1370d2631f/docs/CHANGES · Note
• https://github.com/horde/gollem/commit/a73bef1aef27d4cbfc7b939c2a81dea69aabb083 · Note
• https://lists.debian.org/debian-lts-announce/2020/05/msg00033.html · Note