Cross site scripting

2014-04-0521:55:00

PRIOn knowledge base

www.prio-n.com

6 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.5%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month, (2) monthlist, or (3) prevmonthlist fields, related to portal blocks.

CPENameOperatorVersion
groupwareeq4.0 webamail
groupwareeq4.0.3 webamail
groupwareeq4.0 rc1-webamail
groupwareeq4.0.2 webamail
groupwareeq4.0.7 webamail
groupwareeq4.0.1 webamail
groupwareeq4.0.5 webamail
groupwarele4.0.8
groupwareeq4.0 rc2-webamail
groupwareeq4.0.4 webamail

Name	Operator	Version
groupware	eq	4.0 webamail
groupware	eq	4.0.3 webamail
groupware	eq	4.0 rc1-webamail
groupware	eq	4.0.2 webamail
groupware	eq	4.0.7 webamail
groupware	eq	4.0.1 webamail
groupware	eq	4.0.5 webamail
groupware	le	4.0.8
groupware	eq	4.0 rc2-webamail
groupware	eq	4.0.4 webamail