4.3

CVE-2014-4946

Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Horde ≫ Groupware SwEdition webmail Version <= 5.1.4
Horde ≫ Groupware Version 5.0.0 SwEdition webmail
Horde ≫ Groupware Version 5.0.0 Update rc1 SwEdition webmail
Horde ≫ Groupware Version 5.0.1 SwEdition webmail
Horde ≫ Groupware Version 5.0.2 SwEdition webmail
Horde ≫ Groupware Version 5.0.3 SwEdition webmail
Horde ≫ Groupware Version 5.0.4 SwEdition webmail
Horde ≫ Groupware Version 5.0.5 SwEdition webmail
Horde ≫ Groupware Version 5.1.0 SwEdition webmail
Horde ≫ Groupware Version 5.1.0 Update rc1 SwEdition webmail
Horde ≫ Groupware Version 5.1.1 SwEdition webmail
Horde ≫ Groupware Version 5.1.2 SwEdition webmail
Horde ≫ Groupware Version 5.1.3 SwEdition webmail
Horde ≫ Internet Mail Program Version <= 6.1.7
Horde ≫ Internet Mail Program Version 6.0.0
Horde ≫ Internet Mail Program Version 6.0.0 Update alpha1
Horde ≫ Internet Mail Program Version 6.0.0 Update beta1
Horde ≫ Internet Mail Program Version 6.0.0 Update beta2
Horde ≫ Internet Mail Program Version 6.0.0 Update beta3
Horde ≫ Internet Mail Program Version 6.0.0 Update beta4
Horde ≫ Internet Mail Program Version 6.0.0 Update rc1
Horde ≫ Internet Mail Program Version 6.0.1
Horde ≫ Internet Mail Program Version 6.0.2
Horde ≫ Internet Mail Program Version 6.0.3
Horde ≫ Internet Mail Program Version 6.0.4
Horde ≫ Internet Mail Program Version 6.0.5
Horde ≫ Internet Mail Program Version 6.0.6
Horde ≫ Internet Mail Program Version 6.1.0
Horde ≫ Internet Mail Program Version 6.1.0 Update beta1
Horde ≫ Internet Mail Program Version 6.1.0 Update beta2
Horde ≫ Internet Mail Program Version 6.1.0 Update rc1
Horde ≫ Internet Mail Program Version 6.1.1
Horde ≫ Internet Mail Program Version 6.1.2
Horde ≫ Internet Mail Program Version 6.1.3
Horde ≫ Internet Mail Program Version 6.1.4
Horde ≫ Internet Mail Program Version 6.1.5
Horde ≫ Internet Mail Program Version 6.1.6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.31% 0.669
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://secunia.com/advisories/59770
http://lists.horde.org/archives/announce/2014/001019.html
Vendor Advisory
http://lists.horde.org/archives/announce/2014/001025.html
http://secunia.com/advisories/59772
https://github.com/horde/horde/blob/4513649810f13a32f1193bdeed76f7d85a5efa05/bundles/webmail/docs/CHANGES
https://github.com/horde/horde/blob/c0144ac03814a8c2cf6fc5ac0d1af2653e9ee139/imp/docs/CHANGES