Unscored severity · published Apr 5, 2014
CVE-2012-5566
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote…
–
CVSS
2.5%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote attackers to inject arbitrary web script or HTML via the (1) tasks view or (2) search view.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Groupware · Horde
through 4.0.7; 4.0; 4.0; 4.0; 4.0.1; 4.0.2; +4 more · source: NVD
KH
Kronolith H4 · Horde
through 3.0.16; 3.0; 3.0; 3.0; 3.0; 3.0; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5566
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5566
bugs.horde.org
http://bugs.horde.org/ticket/11189
git.horde.org
http://git.horde.org/horde-git/-/commit/1228a6825a8dab3333d0a8c8986fc10d1f3d11b2
Vendor Advisory
http://lists.horde.org/archives/announce/2012/000773.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html
Vendor Advisory
http://secunia.com/advisories/51469
securitytracker.com
http://securitytracker.com/id?1027106
More from Groupware
9.8
CVE-2020-8518
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution
8.8
CVE-2013-6364
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
8.8
CVE-2019-12095
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a…
8.8
CVE-2019-9858
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17
8.8
CVE-2017-7413
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has…