Cross-Site Scripting Vulnerability in Horde Internet Mail Program and Groupware Webmail Edition
CVE-2012-5565

Currently unrated

Key Information:

Vendor: Horde
Status: Imp
Vendor: CVE Published:; 5 April 2014

What is CVE-2012-5565?

A cross-site scripting vulnerability exists in the js/compose-dimp.js file of the Horde Internet Mail Program (IMP) prior to version 5.0.24. This flaw allows remote attackers to inject arbitrary web scripts or HTML through specially crafted filenames for attached files. It is related to the dynamic view used in the Horde Groupware Webmail Edition prior to version 4.0.9, potentially compromising the security of users and enabling unauthorized actions.

References

http://lists.opensuse.org/opensuse-updates/2012-12/msg000...

vendor-advisoryx_refsource_SUSE

http://lists.horde.org/archives/announce/2012/000833.html

mailing-listx_refsource_MLIST

https://github.com/horde/horde/commit/1550c6ecd7204f9579f...

x_refsource_CONFIRM

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 5, 2014
Vulnerability Reserved
Oct 24, 2012

CVE-2012-5565 Data

JSON