CVE-2016-5303: XSS
First published: Tue Dec 20 2016(Updated: )
Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Horde Groupware Webmail Edition | =5.2.15 | |
| Horde Groupware Webmail Edition | =5.2.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://marc.info/?l=horde-announce&m=147319066126665&w=2
- http://marc.info/?l=horde-announce&m=147319089526753&w=2
- http://www.securityfocus.com/bid/94997
- https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97
- https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424
Frequently Asked Questions
What is the severity of CVE-2016-5303?
CVE-2016-5303 has a moderate severity rating due to its potential impact from cross-site scripting attacks.
How do I fix CVE-2016-5303?
To fix CVE-2016-5303, upgrade to Horde Groupware and Horde Groupware Webmail Edition version 5.2.16 or later.
What types of attacks are possible with CVE-2016-5303?
CVE-2016-5303 allows remote attackers to inject arbitrary web script or HTML through specially crafted content.
Which versions of Horde Groupware are affected by CVE-2016-5303?
CVE-2016-5303 affects Horde Groupware and Horde Groupware Webmail Edition versions before 5.2.16.
Is CVE-2016-5303 a common vulnerability?
CVE-2016-5303 is a known vulnerability that can be exploited in environments using vulnerable versions of Horde.
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/last-modified-date
- agent/severity
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- vendor/horde
- canonical/horde groupware webmail edition
- version/horde groupware webmail edition/5.2.15