Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | imp4 | 4.3.7+debian0-2.2 | DSA-2485-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | horde5-imp | 6.2.5-1.2 | openSUSE-SU-2024:10191-1 |
Advisories 2
- DSA-2485-1 imp4 - cross site scripting Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10191-1 horde5-imp-6.2.5-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www.horde.org/apps/webmail/docs/CHANGES
- DSA-2485 vendor-advisory
- http://www.horde.org/apps/webmail/docs/RELEASE_NOTES
- 1026553 vdb-entry
- http://www.horde.org/apps/imp/docs/RELEASE_NOTES
- 51586 vdb-entry
- 47580 third-party-advisory
- http://www.horde.org/apps/imp/docs/CHANGES
- 1026554 vdb-entry
- [oss-security] 20120121 Re: Re: CVE Request -- Horde IMP -- Multiple XSS flaws mailing-list
- 47592 third-party-advisory