CVE-2012-0791 — Cross-site Scripting in Dynamic IMP

CWE-79 — Cross-site Scripting7 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.6%
top 30.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Horde Dynamic IMPHorde Groupware Webmail EditionHorde IMP
Timeline
PublishedJan 24
Latest updateMay 14

Description

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDhorde/dynamic_imp5.0.17+25
▶NVDhorde/imp48 versions+47

🔴Vulnerability Details

2
GHSA
GHSA-2j7j-jvr9-h35r: Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5↗2022-05-14
▶
VulnCheck
horde dynamic_imp Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')↗2012
▶

💬Community

4
Bugzilla
CVE-2012-0791 CVE-2012-0909 imp: Multiple XSS flaws fixed in v5.0.18 [epel-5]↗2012-01-21
▶
Bugzilla
CVE-2012-0791 CVE-2012-0909 imp: Multiple XSS flaws fixed in v5.0.18↗2012-01-21
▶
Bugzilla
CVE-2012-0791 CVE-2012-0909 imp: Multiple XSS flaws fixed in v5.0.18 [fedora-all]↗2012-01-21
▶
Bugzilla
CVE-2012-0791 CVE-2012-0909 imp: Multiple XSS flaws fixed in v5.0.18 [epel-6]↗2012-01-21
▶