Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote attackers to inject arbitrary web script or HTML via the (1) tasks view or (2) search view.
References
- openSUSE-SU-2012:1625 vendor-advisory
- http://bugs.horde.org/ticket/11189
- 82382 vdb-entry
- [announce] 20120529 Horde Groupware Webmail Edition 4.0.8 (final) mailing-list
- [oss-security] 20121123 CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws mailing-list
- [oss-security] 20121123 Re: CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws mailing-list
- 82371 vdb-entry
- 1027106 vdb-entry
- https://github.com/horde/horde/blob/master/kronolith/docs/CHANGES
- 51469 third-party-advisory
- 56541 vdb-entry
- http://git.horde.org/horde-git/-/commit/1228a6825a8dab3333d0a8c8986fc10d1f3d11b2