Unscored severity · published Jan 16, 2014
CVE-2012-6620
Multiple cross-site scripting (XSS) vulnerabilities in the (1) tasks and (2) search views in Horde Kronolith H4 before 3.0.17 allow remote attackers to inject arbitrary web script…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the (1) tasks and (2) search views in Horde Kronolith H4 before 3.0.17 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KH
Kronolith H4 · Horde
through 3.0.16; 3.0; 3.0; 3.0; 3.0; 3.0; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-6620
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-6620
bugs.horde.org
http://bugs.horde.org/ticket/11189
lists.horde.org
http://lists.horde.org/archives/announce/2012/000766.html
Vendor Advisory
http://secunia.com/advisories/49147
www.securityfocus.com
http://www.securityfocus.com/bid/53731
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/75563
Exploit
https://github.com/horde/horde/commit/1228a6825a8dab3333d0a8c8986fc10d1f3d11b2
More from Kronolith H4
–
CVE-2012-5567
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote…
–
CVE-2012-5566
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote…