7.2
CVE-2025-30349
- EPSS 31.29%
- Veröffentlicht 21.03.2025 00:00:00
- Zuletzt bearbeitet 15.04.2026 00:35:42
- Erkennungen
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerHorde
≫
Produkt
IMP
Default Statusunknown
Version <=
6.2.27
Version
0
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 31.29% | 0.981 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| MITRE | 7.2 | 3.9 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://github.com/horde/webmail/releases/tag/v5.2.22
https://www.horde.org/apps/imp
https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html
https://web.archive.org/web/20250321152616/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html
https://www.horde.org/download/horde
https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L61-L62
https://www.horde.org/apps/horde
https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L23-L25
https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html
https://github.com/horde/imp/releases/tag/v6.2.27
https://github.com/horde/base/releases/tag/v5.2.23
https://web.archive.org/web/20250321162434/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html
https://github.com/natasaka/CVE-2025-30349/
https://lists.debian.org/debian-lts-announce/2025/04/msg00008.html