cnvd - cnvd-2016-13004

CNVD-2016-13004

Vulnerability from cnvd - Published: 2016-12-26

Title

Horde Groupware和Horde Groupware Webmail跨站脚本漏洞

Description

Horde Groupware和Horde Groupware Webmail Edition都是美国Horde公司产品。Horde Groupware是一款免费的基于协作套件的浏览器。Horde Groupware Webmail是一款免费的基于通信套件的企业浏览器。Horde Text Filter API是其中的一个用于过滤和转换文本的方法。 Horde Groupware和Horde Groupware Webmail 5.2.16之前的版本中的Horde Text Filter API存在跨站脚本漏洞。远程攻击者可利用该漏洞注入任意的Web脚本或HTML。

Severity

中

Patch Name

Horde Groupware和Horde Groupware Webmail跨站脚本漏洞的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424

Reference

http://marc.info/?l=horde-announce&m=147319089526753&w=2

Impacted products

Name
['Horde Groupware <5.2.16', 'Horde Groupware Webmail Edition <5.2.16']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94997"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-5303"
    }
  },
  "description": "Horde Groupware\u548cHorde Groupware Webmail Edition\u90fd\u662f\u7f8e\u56fdHorde\u516c\u53f8\u4ea7\u54c1\u3002Horde Groupware\u662f\u4e00\u6b3e\u514d\u8d39\u7684\u57fa\u4e8e\u534f\u4f5c\u5957\u4ef6\u7684\u6d4f\u89c8\u5668\u3002Horde Groupware Webmail\u662f\u4e00\u6b3e\u514d\u8d39\u7684\u57fa\u4e8e\u901a\u4fe1\u5957\u4ef6\u7684\u4f01\u4e1a\u6d4f\u89c8\u5668\u3002Horde Text Filter API\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u8fc7\u6ee4\u548c\u8f6c\u6362\u6587\u672c\u7684\u65b9\u6cd5\u3002\r\n\r\nHorde Groupware\u548cHorde Groupware Webmail 5.2.16\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u7684Horde Text Filter API\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610f\u7684Web\u811a\u672c\u6216HTML\u3002",
  "discovererName": "Liuzhu",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-13004",
  "openTime": "2016-12-26",
  "patchDescription": "Horde Groupware\u548cHorde Groupware Webmail Edition\u90fd\u662f\u7f8e\u56fdHorde\u516c\u53f8\u4ea7\u54c1\u3002Horde Groupware\u662f\u4e00\u6b3e\u514d\u8d39\u7684\u57fa\u4e8e\u534f\u4f5c\u5957\u4ef6\u7684\u6d4f\u89c8\u5668\u3002Horde Groupware Webmail\u662f\u4e00\u6b3e\u514d\u8d39\u7684\u57fa\u4e8e\u901a\u4fe1\u5957\u4ef6\u7684\u4f01\u4e1a\u6d4f\u89c8\u5668\u3002Horde Text Filter API\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u8fc7\u6ee4\u548c\u8f6c\u6362\u6587\u672c\u7684\u65b9\u6cd5\u3002\r\n\r\nHorde Groupware\u548cHorde Groupware Webmail 5.2.16\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u7684Horde Text Filter API\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610f\u7684Web\u811a\u672c\u6216HTML\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Horde Groupware\u548cHorde Groupware Webmail\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Horde Groupware \u003c5.2.16",
      "Horde Groupware Webmail Edition \u003c5.2.16"
    ]
  },
  "referenceLink": "http://marc.info/?l=horde-announce\u0026amp;m=147319089526753\u0026amp;w=2",
  "serverity": "\u4e2d",
  "submitTime": "2016-12-22",
  "title": "Horde Groupware\u548cHorde Groupware Webmail\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2016-5303 (GCVE-0-2016-5303)

Vulnerability from cvelistv5 – Published: 2016-12-20 22:00 – Updated: 2024-08-06 01:00

Summary

Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://github.com/horde/horde/commit/30d5506c20d…	x_refsource_CONFIRM
	http://marc.info/?l=horde-announce&m=147319066126…	mailing-listx_refsource_MLIST
	http://marc.info/?l=horde-announce&m=147319089526…	mailing-listx_refsource_MLIST
	https://github.com/horde/horde/commit/4d8176d1e9e…	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/94997	vdb-entryx_refsource_BID

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:00:57.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97"
          },
          {
            "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware 5.2.16 (final)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=horde-announce\u0026m=147319066126665\u0026w=2"
          },
          {
            "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware Webmail Edition 5.2.16 (final)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=horde-announce\u0026m=147319089526753\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424"
          },
          {
            "name": "94997",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94997"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-09-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-22T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97"
        },
        {
          "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware 5.2.16 (final)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=horde-announce\u0026m=147319066126665\u0026w=2"
        },
        {
          "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware Webmail Edition 5.2.16 (final)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=horde-announce\u0026m=147319089526753\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424"
        },
        {
          "name": "94997",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94997"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-5303",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97",
              "refsource": "CONFIRM",
              "url": "https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97"
            },
            {
              "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware 5.2.16 (final)",
              "refsource": "MLIST",
              "url": "http://marc.info/?l=horde-announce\u0026m=147319066126665\u0026w=2"
            },
            {
              "name": "[horde-announce] 20160906 [SECURITY] Horde Groupware Webmail Edition 5.2.16 (final)",
              "refsource": "MLIST",
              "url": "http://marc.info/?l=horde-announce\u0026m=147319089526753\u0026w=2"
            },
            {
              "name": "https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424",
              "refsource": "CONFIRM",
              "url": "https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424"
            },
            {
              "name": "94997",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94997"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-5303",
    "datePublished": "2016-12-20T22:00:00",
    "dateReserved": "2016-06-06T00:00:00",
    "dateUpdated": "2024-08-06T01:00:57.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-13004

CVE-2016-5303 (GCVE-0-2016-5303)

Tags

Sightings

Nomenclature