CVE-2014-4945: XSS
First published: Mon Jul 14 2014(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Horde Groupware Webmail Edition | <=5.1.4 | |
| Horde Groupware Webmail Edition | =5.0.0 | |
| Horde Groupware Webmail Edition | =5.0.0-rc1 | |
| Horde Groupware Webmail Edition | =5.0.1 | |
| Horde Groupware Webmail Edition | =5.0.2 | |
| Horde Groupware Webmail Edition | =5.0.3 | |
| Horde Groupware Webmail Edition | =5.0.4 | |
| Horde Groupware Webmail Edition | =5.0.5 | |
| Horde Groupware Webmail Edition | =5.1.0 | |
| Horde Groupware Webmail Edition | =5.1.0-rc1 | |
| Horde Groupware Webmail Edition | =5.1.1 | |
| Horde Groupware Webmail Edition | =5.1.2 | |
| Horde Groupware Webmail Edition | =5.1.3 | |
| Horde IMP | <=6.1.7 | |
| Horde IMP | =6.0.0 | |
| Horde IMP | =6.0.0-alpha1 | |
| Horde IMP | =6.0.0-beta1 | |
| Horde IMP | =6.0.0-beta2 | |
| Horde IMP | =6.0.0-beta3 | |
| Horde IMP | =6.0.0-beta4 | |
| Horde IMP | =6.0.0-rc1 | |
| Horde IMP | =6.0.1 | |
| Horde IMP | =6.0.2 | |
| Horde IMP | =6.0.3 | |
| Horde IMP | =6.0.4 | |
| Horde IMP | =6.0.5 | |
| Horde IMP | =6.0.6 | |
| Horde IMP | =6.1.0 | |
| Horde IMP | =6.1.0-beta1 | |
| Horde IMP | =6.1.0-beta2 | |
| Horde IMP | =6.1.0-rc1 | |
| Horde IMP | =6.1.1 | |
| Horde IMP | =6.1.2 | |
| Horde IMP | =6.1.3 | |
| Horde IMP | =6.1.4 | |
| Horde IMP | =6.1.5 | |
| Horde IMP | =6.1.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.horde.org/archives/announce/2014/001019.html
- http://lists.horde.org/archives/announce/2014/001025.html
- http://secunia.com/advisories/59770
- http://secunia.com/advisories/59772
- https://github.com/horde/horde/blob/4513649810f13a32f1193bdeed76f7d85a5efa05/bundles/webmail/docs/CHANGES
- https://github.com/horde/horde/blob/c0144ac03814a8c2cf6fc5ac0d1af2653e9ee139/imp/docs/CHANGES
Frequently Asked Questions
What are the potential risks associated with CVE-2014-4945?
CVE-2014-4945 allows remote attackers to execute arbitrary web scripts or HTML, potentially compromising user data and session integrity.
What versions of Horde Groupware Webmail Edition are vulnerable to CVE-2014-4945?
CVE-2014-4945 affects Horde Groupware Webmail Edition versions prior to 5.1.5, including all versions before 5.1.5.
How can I mitigate CVE-2014-4945 in my environment?
To mitigate CVE-2014-4945, upgrade to Horde Groupware Webmail Edition version 5.1.5 or later, which addresses the identified vulnerabilities.
Are there any specific configurations that could help reduce the impact of CVE-2014-4945?
Implementing input validation and sanitization processes on user inputs can help reduce the potential impact of CVE-2014-4945.
In which areas of Horde Internet Mail Program is CVE-2014-4945 prevalent?
CVE-2014-4945 is prevalent in the mailbox and message view features of the Horde Internet Mail Program.
- agent/references
- agent/type
- agent/softwarecombine
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- vendor/horde
- canonical/horde groupware webmail edition
- version/horde groupware webmail edition/5.1.4
- version/horde groupware webmail edition/5.0.0
- version/horde groupware webmail edition/5.0.0-rc1
- version/horde groupware webmail edition/5.0.1
- version/horde groupware webmail edition/5.0.2
- version/horde groupware webmail edition/5.0.3
- version/horde groupware webmail edition/5.0.4
- version/horde groupware webmail edition/5.0.5
- version/horde groupware webmail edition/5.1.0
- version/horde groupware webmail edition/5.1.0-rc1
- version/horde groupware webmail edition/5.1.1
- version/horde groupware webmail edition/5.1.2
- version/horde groupware webmail edition/5.1.3
- canonical/horde imp
- version/horde imp/6.1.7
- version/horde imp/6.0.0
- version/horde imp/6.0.0-alpha1
- version/horde imp/6.0.0-beta1
- version/horde imp/6.0.0-beta2
- version/horde imp/6.0.0-beta3
- version/horde imp/6.0.0-beta4
- version/horde imp/6.0.0-rc1
- version/horde imp/6.0.1
- version/horde imp/6.0.2
- version/horde imp/6.0.3
- version/horde imp/6.0.4
- version/horde imp/6.0.5
- version/horde imp/6.0.6
- version/horde imp/6.1.0
- version/horde imp/6.1.0-beta1
- version/horde imp/6.1.0-beta2
- version/horde imp/6.1.0-rc1
- version/horde imp/6.1.1
- version/horde imp/6.1.2
- version/horde imp/6.1.3
- version/horde imp/6.1.4
- version/horde imp/6.1.5
- version/horde imp/6.1.6