Unscored severity · published Jan 24, 2012
CVE-2012-0791
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Dynamic Imp · Horde
through 5.0.17; 1.0; 1.0; 1.0; 1.0; 1.0; +26 more · source: NVD
GW
Groupware Webmail Edition · Horde
through 4.0.5; 1.0; 1.0; 1.0; 1.0.1; 1.0.2; +34 more · source: NVD
IM
Imp · Horde
2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0791
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0791
Vendor Advisory
http://secunia.com/advisories/47580
Vendor Advisory
http://secunia.com/advisories/47592
www.debian.org
http://www.debian.org/security/2012/dsa-2485
www.horde.org
http://www.horde.org/apps/imp/docs/CHANGES
www.horde.org
http://www.horde.org/apps/imp/docs/RELEASE_NOTES
www.horde.org
http://www.horde.org/apps/webmail/docs/CHANGES
More from Dynamic Imp
–
CVE-2010-3693
Cross-site scripting (XSS) vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary…