6.0.0-beta4
▾
Tasks
New Task
Search
Photos
Wiki
▾
Tickets
New Ticket
Search
dev.horde.org
Toggle Alerts Log
Help
3/13/26
History
Attachments
Comment
Watch
Download
Comment on [#14926] Horde Webmail - XSS + CSRF to SQLi, RCE, Stealing Emails <= v5.2.22
*
Your Email Address
*
Spam protection
Enter the letters below:
. . __ __..__..__ | |/ `(__ [__][__) |/\|\__..__)| || \
Comment
> Thanks for the follow-up. I also asked MITRE and they offered the > following clarification: > >> The stored XSS should be considered part of the CSRF vulnerability >> in CVE-2019-12095, with the CSRF being the primary vulnerability. >> The reflected XSS vectors are all covered by CVE-2019-12094. > > The CVE database entries have been updated as to be more clear.
Attachment
Watch this ticket
New Ticket
My Tickets
Search
Query Builder
Reports
Saved Queries
Open Bugs
Bugs waiting for Feedback
Open Bugs in Releases
Open Enhancements
Enhancements waiting for Feedback
Bugs with Patches
Enhancements with Patches
Release Showstoppers
Stalled Tickets
New Tickets
Horde 5 Showstoppers