PT-2021-17184 · Horde · Horde Text Filter+1

Alex Birnberg · Published 2021-02-14 · Updated 2021-04-19 · CVE-2021-26929

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Horde Groupware Webmail Edition versions through 5.2.22

Description: An XSS issue was discovered, allowing an attacker to send a plain text e-mail message with JavaScript encoded as a link or email. This is mishandled by preProcess in Text2html.php due to bespoke use of x00x00x00 and x01x01x01, which interferes with XSS defenses.

Recommendations: For Horde Groupware Webmail Edition versions through 5.2.22, update the Horde Text Filter library to version 2.3.7 or later to resolve the issue. As a temporary workaround, consider restricting the handling of plain text e-mail messages with JavaScript encoded links or emails to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-26929

DLA-2564-1

Affected Products

Horde Groupware Webmail Edition

Horde Text Filter

References · 22

• 🔥 https://exploit-db.com/exploits/49769 · Exploit
• 🔥 https://alexbirnberg.com/horde-xss.html · Exploit
• 🔥 http://packetstormsecurity.com/files/162187/Webmail-Edition-5.2.22-XSS-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26929 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-26929 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-26929 · Security Note
• https://ubuntu.com/security/CVE-2021-26929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26929 · Security Note
• https://horde.org/apps/webmail · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2564-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26929 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-26929 · Vendor Advisory
• https://lists.horde.org/archives/announce/2021/001298.html · Vendor Advisory
• https://github.com/horde/webmail/releases · Note
• https://github.com/horde/Text_Filter/commit/a2f67da064d7a91440b7a2448e56a6387ab94c67 · Note