cnvd - cnvd-2016-13004

cnvd-2016-13004

Vulnerability from cnvd

Title: Horde Groupware和Horde Groupware Webmail跨站脚本漏洞

Description:

Horde Groupware和Horde Groupware Webmail Edition都是美国Horde公司产品。Horde Groupware是一款免费的基于协作套件的浏览器。Horde Groupware Webmail是一款免费的基于通信套件的企业浏览器。Horde Text Filter API是其中的一个用于过滤和转换文本的方法。

Horde Groupware和Horde Groupware Webmail 5.2.16之前的版本中的Horde Text Filter API存在跨站脚本漏洞。远程攻击者可利用该漏洞注入任意的Web脚本或HTML。

Severity: 中

Patch Name: Horde Groupware和Horde Groupware Webmail跨站脚本漏洞的补丁

Patch Description:

Horde Groupware和Horde Groupware Webmail 5.2.16之前的版本中的Horde Text Filter API存在跨站脚本漏洞。远程攻击者可利用该漏洞注入任意的Web脚本或HTML。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424

Reference: http://marc.info/?l=horde-announce&m=147319089526753&w=2

Impacted products

Name
['Horde Groupware <5.2.16', 'Horde Groupware Webmail Edition <5.2.16']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94997"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-5303"
    }
  },
  "description": "Horde Groupware\u548cHorde Groupware Webmail Edition\u90fd\u662f\u7f8e\u56fdHorde\u516c\u53f8\u4ea7\u54c1\u3002Horde Groupware\u662f\u4e00\u6b3e\u514d\u8d39\u7684\u57fa\u4e8e\u534f\u4f5c\u5957\u4ef6\u7684\u6d4f\u89c8\u5668\u3002Horde Groupware Webmail\u662f\u4e00\u6b3e\u514d\u8d39\u7684\u57fa\u4e8e\u901a\u4fe1\u5957\u4ef6\u7684\u4f01\u4e1a\u6d4f\u89c8\u5668\u3002Horde Text Filter API\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u8fc7\u6ee4\u548c\u8f6c\u6362\u6587\u672c\u7684\u65b9\u6cd5\u3002\r\n\r\nHorde Groupware\u548cHorde Groupware Webmail 5.2.16\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u7684Horde Text Filter API\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610f\u7684Web\u811a\u672c\u6216HTML\u3002",
  "discovererName": "Liuzhu",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-13004",
  "openTime": "2016-12-26",
  "patchDescription": "Horde Groupware\u548cHorde Groupware Webmail Edition\u90fd\u662f\u7f8e\u56fdHorde\u516c\u53f8\u4ea7\u54c1\u3002Horde Groupware\u662f\u4e00\u6b3e\u514d\u8d39\u7684\u57fa\u4e8e\u534f\u4f5c\u5957\u4ef6\u7684\u6d4f\u89c8\u5668\u3002Horde Groupware Webmail\u662f\u4e00\u6b3e\u514d\u8d39\u7684\u57fa\u4e8e\u901a\u4fe1\u5957\u4ef6\u7684\u4f01\u4e1a\u6d4f\u89c8\u5668\u3002Horde Text Filter API\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u8fc7\u6ee4\u548c\u8f6c\u6362\u6587\u672c\u7684\u65b9\u6cd5\u3002\r\n\r\nHorde Groupware\u548cHorde Groupware Webmail 5.2.16\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u7684Horde Text Filter API\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610f\u7684Web\u811a\u672c\u6216HTML\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Horde Groupware\u548cHorde Groupware Webmail\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Horde Groupware \u003c5.2.16",
      "Horde Groupware Webmail Edition \u003c5.2.16"
    ]
  },
  "referenceLink": "http://marc.info/?l=horde-announce\u0026amp;m=147319089526753\u0026amp;w=2",
  "serverity": "\u4e2d",
  "submitTime": "2016-12-22",
  "title": "Horde Groupware\u548cHorde Groupware Webmail\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2016-5303 (GCVE-0-2016-5303)

Vulnerability from cvelistv5

Published

2016-12-20 22:00

Modified

2024-08-06 01:00

Severity ?

CWE

Summary

Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.

References

▼	URL	Tags
	https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97	x_refsource_CONFIRM
	http://marc.info/?l=horde-announce&m=147319066126665&w=2	mailing-list, x_refsource_MLIST
	http://marc.info/?l=horde-announce&m=147319089526753&w=2	mailing-list, x_refsource_MLIST
	https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/94997	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:00:57.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97"
          },
          {
            "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware 5.2.16 (final)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=horde-announce\u0026m=147319066126665\u0026w=2"
          },
          {
            "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware Webmail Edition 5.2.16 (final)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=horde-announce\u0026m=147319089526753\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424"
          },
          {
            "name": "94997",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94997"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-09-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-22T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97"
        },
        {
          "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware 5.2.16 (final)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=horde-announce\u0026m=147319066126665\u0026w=2"
        },
        {
          "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware Webmail Edition 5.2.16 (final)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=horde-announce\u0026m=147319089526753\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424"
        },
        {
          "name": "94997",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94997"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-5303",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97",
              "refsource": "CONFIRM",
              "url": "https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97"
            },
            {
              "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware 5.2.16 (final)",
              "refsource": "MLIST",
              "url": "http://marc.info/?l=horde-announce\u0026m=147319066126665\u0026w=2"
            },
            {
              "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware Webmail Edition 5.2.16 (final)",
              "refsource": "MLIST",
              "url": "http://marc.info/?l=horde-announce\u0026m=147319089526753\u0026w=2"
            },
            {
              "name": "https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424",
              "refsource": "CONFIRM",
              "url": "https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424"
            },
            {
              "name": "94997",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94997"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-5303",
    "datePublished": "2016-12-20T22:00:00",
    "dateReserved": "2016-06-06T00:00:00",
    "dateUpdated": "2024-08-06T01:00:57.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted