Vulnerability Details CVE-2016-5303
Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 57.1%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
- http://marc.info/?l=horde-announce&m=147319066126665&w=2
- http://marc.info/?l=horde-announce&m=147319089526753&w=2
- http://www.securityfocus.com/bid/94997
- https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97
- https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424
- http://marc.info/?l=horde-announce&m=147319066126665&w=2
- http://marc.info/?l=horde-announce&m=147319089526753&w=2
- http://www.securityfocus.com/bid/94997
- https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97
- https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424