Description
Multiple cross-site scripting (XSS) vulnerabilities in Phpgroupware 0.9.14.003 (aka webdistro) allow remote attackers to insert arbitrary HTML or web script, as demonstrated with a request to index.php in the addressbook module.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | phpgroupware | 0.9.14-0.RC3.2.woody2 | DSA-365 |
Advisories 1
- DSA-365 phpgroupware - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20030702 [KSA-003] Cross Site Scripting Vulnerability in Phpgroupware mailing-list
- http://www.security-corporation.com/articles-20030702-005.html
- MDKSA-2003:077 vendor-advisory
- CLA-2003:697 vendor-advisory
- DSA-365 vendor-advisory