CVE-2012-6640: XSS

Q: What is the severity of CVE-2012-6640?

CVE-2012-6640 has been classified as a medium severity vulnerability due to its potential to allow remote attackers to execute JavaScript or HTML through crafted SVG image attachments.

Q: How do I fix CVE-2012-6640?

To fix CVE-2012-6640, upgrade to Horde Internet Mail Program (IMP) version 5.0.22 or later.

Q: What are the affected versions for CVE-2012-6640?

CVE-2012-6640 affects Horde Internet Mail Program (IMP) versions before 5.0.22 and Horde Groupware Webmail Edition versions before 4.0.9.

Q: Can CVE-2012-6640 be exploited?

Yes, CVE-2012-6640 can be exploited by remote attackers to inject arbitrary web scripts through specially crafted SVG image attachments.

Q: What is the nature of the attack in CVE-2012-6640?

The attack vector for CVE-2012-6640 is cross-site scripting (XSS), allowing attackers to manipulate client-side scripts.

Published Apr 5, 2014

Updated

Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.

Affected Software

37 affected components

Horde Groupware Webmail Edition<=4.0.8

Horde Groupware Webmail Edition=4.0

Horde Groupware Webmail Edition=4.0-rc1

Horde Groupware Webmail Edition=4.0-rc2

Horde Groupware Webmail Edition=4.0.1

Horde Groupware Webmail Edition=4.0.2

Horde Groupware Webmail Edition=4.0.3

Horde Groupware Webmail Edition=4.0.4

Horde Groupware Webmail Edition=4.0.5

Horde Groupware Webmail Edition=4.0.6

Horde Groupware Webmail Edition=4.0.7

Horde IMP<=5.0.21

Horde IMP=5.0

Horde IMP=5.0-alpha1

Horde IMP=5.0-beta1

Horde IMP=5.0-rc1

Horde IMP=5.0-rc2

Horde IMP=5.0.1

Horde IMP=5.0.2

Horde IMP=5.0.3

Horde IMP=5.0.4

Horde IMP=5.0.5

Horde IMP=5.0.6

Horde IMP=5.0.7

Horde IMP=5.0.8

Horde IMP=5.0.9

Horde IMP=5.0.10

Horde IMP=5.0.11

Horde IMP=5.0.12

Horde IMP=5.0.13

Horde IMP=5.0.14

Horde IMP=5.0.15

Horde IMP=5.0.16

Horde IMP=5.0.17

Horde IMP=5.0.18

Horde IMP=5.0.19

Horde IMP=5.0.20

Event History

Apr 5, 2014

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Data Sourced

via NVD·09:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2012-6640?

CVE-2012-6640 has been classified as a medium severity vulnerability due to its potential to allow remote attackers to execute JavaScript or HTML through crafted SVG image attachments.

How do I fix CVE-2012-6640?

To fix CVE-2012-6640, upgrade to Horde Internet Mail Program (IMP) version 5.0.22 or later.

What are the affected versions for CVE-2012-6640?

CVE-2012-6640 affects Horde Internet Mail Program (IMP) versions before 5.0.22 and Horde Groupware Webmail Edition versions before 4.0.9.

Can CVE-2012-6640 be exploited?

Yes, CVE-2012-6640 can be exploited by remote attackers to inject arbitrary web scripts through specially crafted SVG image attachments.

What is the nature of the attack in CVE-2012-6640?