Vulnerability Details CVE-2011-4950
Cross-site scripting (XSS) vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 68.2%
CVSS Severity
CVSS v2 Score 4.3
References
- http://comments.gmane.org/gmane.comp.web.egroupware.german/33144
- http://packetstormsecurity.org/files/100180/eGroupware-1.8.001-Cross-Site-Scripting.html
- http://www.autosectools.com/Advisory/eGroupware-1.8.001-Reflected-Cross-site-Scripting-178
- http://www.egroupware.org/changelog
- http://www.egroupware.org/epl-changelog
- http://www.openwall.com/lists/oss-security/2012/03/29/1
- http://www.openwall.com/lists/oss-security/2012/03/30/3
- http://www.securityfocus.com/bid/52770
- http://comments.gmane.org/gmane.comp.web.egroupware.german/33144
- http://packetstormsecurity.org/files/100180/eGroupware-1.8.001-Cross-Site-Scripting.html
- http://www.autosectools.com/Advisory/eGroupware-1.8.001-Reflected-Cross-site-Scripting-178
- http://www.egroupware.org/changelog
- http://www.egroupware.org/epl-changelog
- http://www.openwall.com/lists/oss-security/2012/03/29/1
- http://www.openwall.com/lists/oss-security/2012/03/30/3
- http://www.securityfocus.com/bid/52770
Products affected by CVE-2011-4950
-
cpe:2.3:a:egroupware:egroupware:1.8.001.20110421
-
cpe:2.3:a:egroupware:egroupware_enterprise_line:11.1.20110711-1