CVE-2022-26874: XSS
lib/Horde/Mime/Viewer/Ooo.php in Horde MimeViewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/php-horde-mime-viewerto a version that resolves this vulnerability.Fixed in 2.2.4+debian0-2 - Upgrade
Upgrade
debian/php-horde-mime-viewerto a version that resolves this vulnerability.Fixed in 2.2.4+debian0-1
Event History
Frequently Asked Questions
What is CVE-2022-26874?
CVE-2022-26874 is a vulnerability in the Horde Mime_Viewer library that allows XSS attacks via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition.
How does CVE-2022-26874 affect Horde Mime_Viewer?
CVE-2022-26874 affects Horde Mime_Viewer versions before 2.2.4, allowing XSS attacks through OpenOffice documents.
What is the severity of CVE-2022-26874?
The severity of CVE-2022-26874 is medium, with a severity score of 5.4.
How can I fix CVE-2022-26874?
To fix CVE-2022-26874, upgrade to Horde Mime_Viewer version 2.2.4 or above.
Are there any references for CVE-2022-26874?
Yes, you can find references for CVE-2022-26874 at the following links: [link1], [link2], [link3].