{"api_version":"1","generated_at":"2026-07-23T07:56:37+00:00","cve":"CVE-2012-5567","urls":{"html":"https://cve.report/CVE-2012-5567","api":"https://cve.report/api/cve/CVE-2012-5567.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-5567","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-5567"},"summary":{"title":"CVE-2012-5567","description":"Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month, (2) monthlist, or (3) prevmonthlist fields, related to portal blocks.","state":"PUBLISHED","assigner":"redhat","published_at":"2014-04-05 21:55:06","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES","name":"https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"horde/CHANGES at d3dda2d47fad7eb128a0091e732cded0c2601009 · horde/horde · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51233","name":"http://secunia.com/advisories/51233","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e","name":"http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Horde :: Log in","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=879684","name":"https://bugzilla.redhat.com/show_bug.cgi?id=879684","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"879684 – (CVE-2012-5567) CVE-2012-5567 kronolith: Multiple XSS flaws in the portal blocks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.horde.org/archives/announce/2012/000836.html","name":"http://lists.horde.org/archives/announce/2012/000836.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[announce] Kronolith H4 (3.0.18) (final)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/56541","name":"http://www.securityfocus.com/bid/56541","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Multiple Horde Products Multiple Unspecified HTML Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.openwall.com/lists/oss-security/2012/11/23/3","name":"http://www.openwall.com/lists/oss-security/2012/11/23/3","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/87345","name":"http://www.osvdb.org/87345","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html","name":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"openSUSE-SU-2012:1625-1: moderate: horde4-kronolith","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2012/11/23/7","name":"http://www.openwall.com/lists/oss-security/2012/11/23/7","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - Re: CVE Request -- kronolith: Two sets (3.0.17 &&\n 3.0.18) of XSS flaws","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51469","name":"http://secunia.com/advisories/51469","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5567","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5567","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"groupware","cpe6":"4.0","cpe7":"*","cpe8":"webamail","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"groupware","cpe6":"4.0","cpe7":"rc1","cpe8":"webamail","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"groupware","cpe6":"4.0","cpe7":"rc2","cpe8":"webamail","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"groupware","cpe6":"4.0.1","cpe7":"*","cpe8":"webamail","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"groupware","cpe6":"4.0.2","cpe7":"*","cpe8":"webamail","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"groupware","cpe6":"4.0.3","cpe7":"*","cpe8":"webamail","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"groupware","cpe6":"4.0.4","cpe7":"*","cpe8":"webamail","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"groupware","cpe6":"4.0.5","cpe7":"*","cpe8":"webamail","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"groupware","cpe6":"4.0.6","cpe7":"*","cpe8":"webamail","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"groupware","cpe6":"4.0.7","cpe7":"*","cpe8":"webamail","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"4.0.8","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"groupware","cpe6":"*","cpe7":"*","cpe8":"webamail","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0","cpe7":"alpha1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0","cpe7":"rc2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.13","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.15","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.16","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"3.0.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5567","vulnerable":"1","versionEndIncluding":"3.0.17","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"horde","cpe5":"kronolith_h4","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T21:14:15.603Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES"},{"name":"openSUSE-SU-2012:1625","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html"},{"name":"[oss-security] 20121123 CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2012/11/23/3"},{"name":"[oss-security] 20121123 Re: CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2012/11/23/7"},{"name":"51233","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51233"},{"name":"[announce] 20121114 Kronolith H4 (3.0.18) (final)","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://lists.horde.org/archives/announce/2012/000836.html"},{"name":"51469","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51469"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=879684"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e"},{"name":"56541","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/56541"},{"name":"87345","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/87345"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-11-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month, (2) monthlist, or (3) prevmonthlist fields, related to portal blocks."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-04-05T19:57:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES"},{"name":"openSUSE-SU-2012:1625","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html"},{"name":"[oss-security] 20121123 CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2012/11/23/3"},{"name":"[oss-security] 20121123 Re: CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2012/11/23/7"},{"name":"51233","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51233"},{"name":"[announce] 20121114 Kronolith H4 (3.0.18) (final)","tags":["mailing-list","x_refsource_MLIST"],"url":"http://lists.horde.org/archives/announce/2012/000836.html"},{"name":"51469","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51469"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=879684"},{"tags":["x_refsource_CONFIRM"],"url":"http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e"},{"name":"56541","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/56541"},{"name":"87345","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/87345"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2012-5567","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month, (2) monthlist, or (3) prevmonthlist fields, related to portal blocks."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES","refsource":"CONFIRM","url":"https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES"},{"name":"openSUSE-SU-2012:1625","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html"},{"name":"[oss-security] 20121123 CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2012/11/23/3"},{"name":"[oss-security] 20121123 Re: CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2012/11/23/7"},{"name":"51233","refsource":"SECUNIA","url":"http://secunia.com/advisories/51233"},{"name":"[announce] 20121114 Kronolith H4 (3.0.18) (final)","refsource":"MLIST","url":"http://lists.horde.org/archives/announce/2012/000836.html"},{"name":"51469","refsource":"SECUNIA","url":"http://secunia.com/advisories/51469"},{"name":"https://bugzilla.redhat.com/show_bug.cgi?id=879684","refsource":"CONFIRM","url":"https://bugzilla.redhat.com/show_bug.cgi?id=879684"},{"name":"http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e","refsource":"CONFIRM","url":"http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e"},{"name":"56541","refsource":"BID","url":"http://www.securityfocus.com/bid/56541"},{"name":"87345","refsource":"OSVDB","url":"http://www.osvdb.org/87345"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2012-5567","datePublished":"2014-04-05T21:00:00.000Z","dateReserved":"2012-10-24T00:00:00.000Z","dateUpdated":"2024-08-06T21:14:15.603Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-04-05 21:55:06","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:horde:groupware:*:*:webamail:*:*:*:*:*","versionEndIncluding":"4.0.8","matchCriteriaId":"E888C8C2-27C5-4BD0-9EEE-750DF5DE6488"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:groupware:4.0:*:webamail:*:*:*:*:*","matchCriteriaId":"F505E80A-B91C-401C-9B77-F34B00ECA434"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:groupware:4.0:rc1:webamail:*:*:*:*:*","matchCriteriaId":"A9129D4A-F365-4630-976A-DBFBBEA531FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:groupware:4.0:rc2:webamail:*:*:*:*:*","matchCriteriaId":"C910D464-66B3-4593-A7D8-3FD3EADB9AFE"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:groupware:4.0.1:*:webamail:*:*:*:*:*","matchCriteriaId":"A6A67FDD-C9CE-43E4-ADD9-DB5699BEF61C"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:groupware:4.0.2:*:webamail:*:*:*:*:*","matchCriteriaId":"A1158FCA-2AAB-4EC4-9B34-F1B44DDA4FA9"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:groupware:4.0.3:*:webamail:*:*:*:*:*","matchCriteriaId":"2A0A5DB9-3731-466D-8D0F-7BE71A34184B"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:groupware:4.0.4:*:webamail:*:*:*:*:*","matchCriteriaId":"5D07339E-54B9-4513-82EB-0FB53AD5B82B"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:groupware:4.0.5:*:webamail:*:*:*:*:*","matchCriteriaId":"717CB664-818F-4583-83FF-47B167993569"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:groupware:4.0.6:*:webamail:*:*:*:*:*","matchCriteriaId":"185839EF-1F07-4C2C-B710-FD607EAD0A71"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:groupware:4.0.7:*:webamail:*:*:*:*:*","matchCriteriaId":"29D96163-C022-4DBD-8B94-746665B99A73"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:*:*:*:*:*:*:*:*","versionEndIncluding":"3.0.17","matchCriteriaId":"CF9C1B7C-8DE5-4925-9651-9204FB96667B"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0:*:*:*:*:*:*:*","matchCriteriaId":"F75CC603-45D1-4FAB-8E4D-B5CF7F6FC99A"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0:alpha1:*:*:*:*:*:*","matchCriteriaId":"C3C905F8-1A2F-46A4-AD0F-9118AC3CC16D"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0:beta1:*:*:*:*:*:*","matchCriteriaId":"B60EDA48-5703-4A6D-906D-8BB833B3CC34"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0:rc1:*:*:*:*:*:*","matchCriteriaId":"B887A9E9-C8D2-4622-A4E8-A39E5DCD0301"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0:rc2:*:*:*:*:*:*","matchCriteriaId":"BD8032AE-F6E0-498C-A473-B1215DD4FF25"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.1:*:*:*:*:*:*:*","matchCriteriaId":"1823C3C8-3C94-4991-9ADE-7D966093F2C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.2:*:*:*:*:*:*:*","matchCriteriaId":"1E5535C3-442C-41C1-9EDD-BC5FA23C9E80"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.3:*:*:*:*:*:*:*","matchCriteriaId":"5F4111B8-1AC2-4C36-8366-1E70FDA8EF49"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.4:*:*:*:*:*:*:*","matchCriteriaId":"5CEEE7D7-13BA-4F25-8E82-00F59CA52CD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.5:*:*:*:*:*:*:*","matchCriteriaId":"4D2EAFA0-CC18-4B73-B72F-A467AEE62803"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.6:*:*:*:*:*:*:*","matchCriteriaId":"8007A3CC-5916-42A9-9892-969A3BC49E7F"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.7:*:*:*:*:*:*:*","matchCriteriaId":"5581E8B0-344B-41DB-9892-F4F36324E743"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.8:*:*:*:*:*:*:*","matchCriteriaId":"7E82DBE7-5230-45A8-B6E7-2C73B1867134"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.9:*:*:*:*:*:*:*","matchCriteriaId":"02646219-43E5-4912-B003-F6556582C399"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.10:*:*:*:*:*:*:*","matchCriteriaId":"54D4B84A-713E-4918-AB12-603D300901FD"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.11:*:*:*:*:*:*:*","matchCriteriaId":"B804D928-5962-4C23-93FE-532E58891B43"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.12:*:*:*:*:*:*:*","matchCriteriaId":"ABC86F11-5EED-4BB3-A53C-D3749103EF1C"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.13:*:*:*:*:*:*:*","matchCriteriaId":"AB1D4DCE-A86A-4155-A249-2BB5B875A934"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.14:*:*:*:*:*:*:*","matchCriteriaId":"E54F5C8A-7E89-4C80-9228-BCB121D8DA6C"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.15:*:*:*:*:*:*:*","matchCriteriaId":"25BE11AE-6988-4754-9102-4704707F6182"},{"vulnerable":true,"criteria":"cpe:2.3:a:horde:kronolith_h4:3.0.16:*:*:*:*:*:*:*","matchCriteriaId":"8BD48168-FCC7-49C4-AC41-3E55DCF62702"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"5567","Ordinal":"1","Title":"CVE-2012-5567","CVE":"CVE-2012-5567","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"5567","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month, (2) monthlist, or (3) prevmonthlist fields, related to portal blocks.","Type":"Description","Title":"CVE-2012-5567"},{"CveYear":"2012","CveId":"5567","Ordinal":"2","NoteData":"2014-04-05","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"5567","Ordinal":"3","NoteData":"2014-04-05","Type":"Other","Title":"Modified"}]}}}