Reflected XSS Vulnerability in eGroupWare Calendar Module
CVE-2023-38329

6.1MEDIUM

Key Information:

Vendor

eGroupWare

Status
eGroupWare
Vendor
CVE Published:
11 July 2025

What is CVE-2023-38329?

A reflected cross-site scripting (XSS) vulnerability exists in eGroupWare's calendar/freebusy.php file, impacting version 17.1.20190111. This vulnerability enables unauthenticated remote attackers to inject arbitrary web scripts or HTML through the 'user' parameter in HTTP GET requests, reflecting user input without proper sanitization. This flaw poses a significant risk by allowing attackers to execute malicious scripts in the context of unsuspecting users' browsers.

References

https://www.gruppotim.it/it/footer/red-team.html

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.