CVE-2019-12095: CSRF
First published: Thu Oct 24 2019(Updated: )
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Horde Groupware | <=5.2.22 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.horde.org/ticket/14926
- https://cxsecurity.com/issue/WLB-2019050199
- https://exchange.xforce.ibmcloud.com/vulnerabilities/161333
- https://lists.debian.org/debian-lts-announce/2019/12/msg00015.html
- https://numanozdemir.com/respdisc/horde/horde.mp4
- https://numanozdemir.com/respdisc/horde/horde.txt
- https://packetstormsecurity.com/files/152975/Horde-Webmail-5.2.22-XSS-CSRF-SQL-Injection-Code-Execution.html
- https://www.exploit-db.com/exploits/46903
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2019-12095.
What is the severity score of CVE-2019-12095?
The severity score of CVE-2019-12095 is 8.8 (high).
Which products are affected by CVE-2019-12095?
Horde Groupware Webmail Edition through 5.2.22 and other products are affected by CVE-2019-12095.
What is the CWE ID associated with CVE-2019-12095?
The CWE ID associated with CVE-2019-12095 is CWE-79 and CWE-352.
Are there any references available for CVE-2019-12095?
Yes, the following references are available for CVE-2019-12095: [Reference 1](https://bugs.horde.org/ticket/14926), [Reference 2](https://cxsecurity.com/issue/WLB-2019050199), [Reference 3](https://exchange.xforce.ibmcloud.com/vulnerabilities/161333).
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/horde
- canonical/horde groupware
- version/horde groupware/5.2.22