Groupware Webmail Edition CVE-2012-6640 Cross-Site Scripting Vulnerability
BID:73882
Info
Groupware Webmail Edition CVE-2012-6640 Cross-Site Scripting Vulnerability
| Bugtraq ID: | 73882 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-6640 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 05 2014 12:00AM |
| Updated: | Apr 05 2014 12:00AM |
| Credit: | Unknown |
| Vulnerable: |
Horde Project IMP 5.0.20 Horde Project IMP 5.0.19 Horde Project IMP 5.0.18 Horde Project IMP 5.0.16 Horde Project IMP 5.0.15 Horde Project IMP 5.0.14 Horde Project IMP 5.0.13 Horde Project IMP 5.0.12 Horde Project IMP 5.0.11 Horde Project IMP 5.0.10 Horde Project IMP 5.0.6 Horde Project IMP 5.0.5 Horde Project IMP 4.7.7 Horde Project IMP 5.0.9 Horde Project IMP 5.0.8 Horde Project IMP 5.0.4 Horde Project IMP 5.0.3 Horde Project IMP 5.0.21 Horde Project IMP 5.0.2 Horde Project IMP 5.0.17 Horde Project IMP 5.0.1 Horde Project IMP 5.0 Rc2 Horde Project IMP 5.0 Rc1 Horde Project IMP 5.0 Beta1 Horde Project IMP 5.0 Alpha1 Horde Project IMP 5.0 Horde Project Groupware Webmail Edition 4.0.8 Webamail Horde Project Groupware Webmail Edition 4.0.6 Webamail Horde Project Groupware Webmail Edition 4.0.4 Webamail Horde Project Groupware Webmail Edition 4.0.2 Webamail Horde Project Groupware Webmail Edition 4.0 Rc1 Webamail Horde Project Groupware 4.0.7 Webamail Horde Project Groupware 4.0.5 Webamail Horde Project Groupware 4.0.3 Webamail Horde Project Groupware 4.0.1 Webamail Horde Project Groupware 4.0 Webamail Horde Project Groupware 4.0 Rc2 Webamail |
| Not Vulnerable: | |
Discussion
Groupware Webmail Edition CVE-2012-6640 Cross-Site Scripting Vulnerability
Groupware Webmail Edition is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.
Groupware Webmail Edition is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.
Exploit / POC
Groupware Webmail Edition CVE-2012-6640 Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
Groupware Webmail Edition CVE-2012-6640 Cross-Site Scripting Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]
References
Groupware Webmail Edition CVE-2012-6640 Cross-Site Scripting Vulnerability
References:
References:
- https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc (MISC)
- IMP H4 (5.0.22) (final) (Mike Cardwell)
- [announce] Horde Groupware Webmail Edition 4.0.9 (final) (Horde Project)