Unscored CVE-2016-6191 EUVD-2016-7124GHSA-mcp4-fq7j-35pr

Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attac…

Published Feb 17, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Package: sogo Package: sogo Ecosystem: Debian Ecosystem: Ubuntu

Description

Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Description, (2) Location, (3) URL, or (4) Title field.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 13	sogo	3.2.4-0.2	—
Debian 12	sogo	3.2.4-0.2	—

Ubuntu