XSS Vulnerability in Horde Internet Mail Program Affecting Horde Groupware Webmail Edition
CVE-2012-6640

Currently unrated

Key Information:

Vendor: Horde
Status: Groupware
Vendor: CVE Published:; 5 April 2014

What is CVE-2012-6640?

A cross-site scripting (XSS) vulnerability exists in the Horde Internet Mail Program (IMP) prior to version 5.0.22, as utilized in the Horde Groupware Webmail Edition before version 4.0.9. This vulnerability enables remote attackers to exploit the system by injecting arbitrary web script or HTML through a specially crafted SVG image attachment. This poses a significant security risk as it can lead to unauthorized access and manipulation of user sessions or data.

References

http://lists.horde.org/archives/announce/2012/000775.html

mailing-listx_refsource_MLIST

https://github.com/horde/horde/commit/08c699f744b6d2be1a5...

x_refsource_CONFIRM

http://lists.horde.org/archives/announce/2012/000840.html

mailing-listx_refsource_MLIST

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability Reserved
Oct 3, 2022
Vulnerability published
Apr 5, 2014

CVE-2012-6640 Data

JSON