CVE-2012-5565 — Cross-site Scripting in Php-horde-imp

CWE-79 — Cross-site Scripting9 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 47.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Debian Php-horde-impHorde GroupwareHorde IMP
Timeline
PublishedApr 5
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDhorde/groupware4.0.8+8
▶debiandebian/php-horde-imp< php-horde-imp 5.0.22 (bookworm)+1
▶NVDhorde/imp5.0.21+24

🔴Vulnerability Details

5
GHSA
GHSA-rh3v-pr53-rxj5: Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5↗2022-05-17
▶
GHSA
GHSA-6j8r-p393-w37g: Cross-site scripting (XSS) vulnerability in js/compose-dimp↗2022-05-17
▶
CVEList
CVE-2012-6640: Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5↗2014-04-05
▶
OSV
CVE-2012-6640: Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5↗2014-04-05
▶
CVEList
CVE-2012-5565: Cross-site scripting (XSS) vulnerability in js/compose-dimp↗2014-04-05
▶

📋Vendor Advisories

2
Debian
CVE-2012-6640: php-horde-imp - Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) be...↗2012
▶
Debian
CVE-2012-5565: php-horde-imp - Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet...↗2012
▶