Описание
In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed.
Ссылки
- ExploitIssue TrackingThird Party Advisory
- PatchVendor Advisory
- ExploitIssue TrackingThird Party Advisory
- PatchVendor Advisory
Уязвимые конфигурации
EPSS
5.4 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
Связанные уязвимости
In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed.
In Horde Groupware 5.2.19, there is XSS via the Name field during crea ...
In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed.
EPSS
5.4 Medium
CVSS3
3.5 Low
CVSS2