CVE-2012-6640 — Cross-site Scripting in Php-horde-imp

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 46.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Debian Php-horde-impHorde GroupwareHorde IMP
Timeline
PublishedApr 5
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDhorde/groupware4.0.8+8
▶debiandebian/php-horde-imp< php-horde-imp 5.0.22 (bookworm)
▶NVDhorde/imp5.0.21+21

🔴Vulnerability Details

2
GHSA
GHSA-rh3v-pr53-rxj5: Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5↗2022-05-17
▶
OSV
CVE-2012-6640: Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5↗2014-04-05
▶

📋Vendor Advisories

1
Debian
CVE-2012-6640: php-horde-imp - Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) be...↗2012
▶