Medium · 5.4 CVE-2007-1679 EUVD-2007-1673GHSA-q5ww-rhx4-prr5

Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web…

Published Mar 26, 2007 · Updated Jan 17, 2025 · Assigned by mitre

Description

Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in (1) imp/search.php and (2) ingo/rule.php. NOTE: this issue has been disputed by the vendor, noting that the search.php issue was resolved in CVE-2006-4255, and attackers can only use rule.php to inject XSS into their own pages

References

horde-search-rule-xss(33228) vdb-entry
20070325 Horde Webmail Multiple HTML Injection vulnerability mailing-list
2487 third-party-advisory
23136 vdb-entry
20070326 Re: Horde Webmail Multiple HTML Injection vulnerability mailing-list