CVE-2020-8034: XSS
Published May 18, 2020
·Updated
Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
Affected Software
2 affected components
Horde Gollem<3.0.13
Horde Groupware Webmail Edition=5.2.22
Remediation
Patch Available
Event History
May 18, 2020
CVE Published
via MITRE·04:07 PM
Data Sourced
via MITRE·04:07 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2020-8034.
2
What is the severity of CVE-2020-8034?
The severity of CVE-2020-8034 is medium.
3
Which software versions are affected by CVE-2020-8034?
Gollem before version 3.0.13 and Horde Groupware Webmail Edition 5.2.22 are affected by this vulnerability.
4
What is the CWE ID of CVE-2020-8034?
The CWE ID of CVE-2020-8034 is CWE-79.
5
How can I fix CVE-2020-8034?
To fix CVE-2020-8034, you should update to version 3.0.13 or higher of Gollem and version 5.2.23 or higher of Horde Groupware Webmail Edition.