CVE-2014-4946 — Cross-site Scripting in Php-horde-imp

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.5%
top 35.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Debian Php-horde-impHorde GroupwareHorde Internet Mail Program
Timeline
PublishedJul 14
Latest updateMay 17

Description

Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDhorde/groupware5.1.4+10
▶debiandebian/php-horde-imp< php-horde-imp 6.2.0-1 (bookworm)

🔴Vulnerability Details

2
GHSA
GHSA-ffjw-6mf8-2rj5: Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6↗2022-05-17
▶
OSV
CVE-2014-4946: Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6↗2014-07-14
▶

📋Vendor Advisories

1
Debian
CVE-2014-4946: php-horde-imp - Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Progr...↗2014
▶