CVE-2014-4946: XSS
First published: Mon Jul 14 2014(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Horde Groupware Webmail Edition | <=5.1.4 | |
| Horde Groupware Webmail Edition | =5.0.0 | |
| Horde Groupware Webmail Edition | =5.0.0-rc1 | |
| Horde Groupware Webmail Edition | =5.0.1 | |
| Horde Groupware Webmail Edition | =5.0.2 | |
| Horde Groupware Webmail Edition | =5.0.3 | |
| Horde Groupware Webmail Edition | =5.0.4 | |
| Horde Groupware Webmail Edition | =5.0.5 | |
| Horde Groupware Webmail Edition | =5.1.0 | |
| Horde Groupware Webmail Edition | =5.1.0-rc1 | |
| Horde Groupware Webmail Edition | =5.1.1 | |
| Horde Groupware Webmail Edition | =5.1.2 | |
| Horde Groupware Webmail Edition | =5.1.3 | |
| Horde IMP | <=6.1.7 | |
| Horde IMP | =6.0.0 | |
| Horde IMP | =6.0.0-alpha1 | |
| Horde IMP | =6.0.0-beta1 | |
| Horde IMP | =6.0.0-beta2 | |
| Horde IMP | =6.0.0-beta3 | |
| Horde IMP | =6.0.0-beta4 | |
| Horde IMP | =6.0.0-rc1 | |
| Horde IMP | =6.0.1 | |
| Horde IMP | =6.0.2 | |
| Horde IMP | =6.0.3 | |
| Horde IMP | =6.0.4 | |
| Horde IMP | =6.0.5 | |
| Horde IMP | =6.0.6 | |
| Horde IMP | =6.1.0 | |
| Horde IMP | =6.1.0-beta1 | |
| Horde IMP | =6.1.0-beta2 | |
| Horde IMP | =6.1.0-rc1 | |
| Horde IMP | =6.1.1 | |
| Horde IMP | =6.1.2 | |
| Horde IMP | =6.1.3 | |
| Horde IMP | =6.1.4 | |
| Horde IMP | =6.1.5 | |
| Horde IMP | =6.1.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.horde.org/archives/announce/2014/001019.html
- http://lists.horde.org/archives/announce/2014/001025.html
- http://secunia.com/advisories/59770
- http://secunia.com/advisories/59772
- https://github.com/horde/horde/blob/4513649810f13a32f1193bdeed76f7d85a5efa05/bundles/webmail/docs/CHANGES
- https://github.com/horde/horde/blob/c0144ac03814a8c2cf6fc5ac0d1af2653e9ee139/imp/docs/CHANGES
Frequently Asked Questions
What is the severity of CVE-2014-4946?
CVE-2014-4946 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.
How do I fix CVE-2014-4946?
To fix CVE-2014-4946, upgrade Horde Internet Mail Program (IMP) to version 6.1.8 or later and ensure Horde Groupware Webmail Edition is updated to version 5.1.5 or later.
What types of software are affected by CVE-2014-4946?
CVE-2014-4946 affects Horde Internet Mail Program (IMP) versions prior to 6.1.8 and Horde Groupware Webmail Edition versions before 5.1.5.
Can CVE-2014-4946 lead to data compromise?
Yes, CVE-2014-4946 can enable attackers to inject arbitrary web scripts, potentially leading to data compromise.
Are there any known exploits for CVE-2014-4946?
There are no specific publicly known exploits for CVE-2014-4946, but the XSS vulnerabilities present a significant risk.
- agent/references
- agent/type
- agent/softwarecombine
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- vendor/horde
- canonical/horde groupware webmail edition
- version/horde groupware webmail edition/5.1.4
- version/horde groupware webmail edition/5.0.0
- version/horde groupware webmail edition/5.0.0-rc1
- version/horde groupware webmail edition/5.0.1
- version/horde groupware webmail edition/5.0.2
- version/horde groupware webmail edition/5.0.3
- version/horde groupware webmail edition/5.0.4
- version/horde groupware webmail edition/5.0.5
- version/horde groupware webmail edition/5.1.0
- version/horde groupware webmail edition/5.1.0-rc1
- version/horde groupware webmail edition/5.1.1
- version/horde groupware webmail edition/5.1.2
- version/horde groupware webmail edition/5.1.3
- canonical/horde imp
- version/horde imp/6.1.7
- version/horde imp/6.0.0
- version/horde imp/6.0.0-alpha1
- version/horde imp/6.0.0-beta1
- version/horde imp/6.0.0-beta2
- version/horde imp/6.0.0-beta3
- version/horde imp/6.0.0-beta4
- version/horde imp/6.0.0-rc1
- version/horde imp/6.0.1
- version/horde imp/6.0.2
- version/horde imp/6.0.3
- version/horde imp/6.0.4
- version/horde imp/6.0.5
- version/horde imp/6.0.6
- version/horde imp/6.1.0
- version/horde imp/6.1.0-beta1
- version/horde imp/6.1.0-beta2
- version/horde imp/6.1.0-rc1
- version/horde imp/6.1.1
- version/horde imp/6.1.2
- version/horde imp/6.1.3
- version/horde imp/6.1.4
- version/horde imp/6.1.5
- version/horde imp/6.1.6