Description
Cross-site scripting (XSS) vulnerability in Horde_Form in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to email verification. NOTE: Some of these details are obtained from third party information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | horde5-imp | 6.2.5-1.2 | openSUSE-SU-2024:10191-1 |
Advisories 1
- openSUSE-SU-2024:10191-1 horde5-imp-6.2.5-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www.horde.org/apps/webmail/docs/CHANGES
- http://www.horde.org/apps/webmail/docs/RELEASE_NOTES
- 51586 vdb-entry
- [oss-security] 20120121 Re: Re: CVE Request -- Horde IMP -- Multiple XSS flaws mailing-list
- 47592 third-party-advisory