Vulnerability Description
Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fedoraproject | Fedora | 22 |
| Horde | Groupware | 5.2.11 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.h
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.h
- http://lists.horde.org/archives/announce/2016/001148.htmlVendor Advisory
- http://lists.horde.org/archives/announce/2016/001149.htmlVendor Advisory
- http://www.debian.org/security/2016/dsa-3496
- http://www.openwall.com/lists/oss-security/2016/02/06/4
- http://www.openwall.com/lists/oss-security/2016/02/06/5
- https://github.com/horde/horde/blob/e838d4c800b0d1ecaf8b4cc613fd3af4f994c79c/bunExploit
- https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.h
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.h
- http://lists.horde.org/archives/announce/2016/001148.htmlVendor Advisory
- http://lists.horde.org/archives/announce/2016/001149.htmlVendor Advisory
- http://www.debian.org/security/2016/dsa-3496
- http://www.openwall.com/lists/oss-security/2016/02/06/4
FAQ
What is CVE-2015-8807?
CVE-2015-8807 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webm...
How severe is CVE-2015-8807?
CVE-2015-8807 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-8807?
Check the references section above for vendor advisories and patch information. Affected products include: Fedoraproject Fedora, Horde Groupware, Debian Debian Linux.