Medium · 6.1 CVE-2017-14920 EUVD-2022-4960GHSA-qfg7-wc25-r3j2

eGroupware Community Edition Stored XSS vulnerability

Published Sep 29, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Package: egroupware/egroupware Ecosystem: Packagist

Description

Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the application administrator.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	egroupware/egroupware	< 16.1.20170922	16.1.20170922	GHSA-qfg7-wc25-r3j2

References

http://openwall.com/lists/oss-security/2017/09/28/12
https://github.com/EGroupware/egroupware/commit/0ececf8c78f1c3f9ba15465f53a682dd7d89529f