Tickets :: Comment on [#14926] Horde Webmail - XSS + CSRF to SQLi, RCE, Stealing Emails <= v5.2.22

* Your Email Address
* Spam protection	Enter the letters below: .__. __ .. ..__ \| \|/ ` \|\ /[ __ \|__\\__.\__\| \/ [_./
Comment	>> The original report included the following: >> >>> # Attacker can combine "CSRF vulnerability in Trean Bookmarks >>> (defaultly installed on Horde Groupware)" and >>> # "Stored XSS vulnerability in Horde TagCloud (defaultly installed)" >>> vulnerabilities to steal victim's emails. >>> >>> # Also: >>> # Attacker can use 3 different reflected XSS vulnerability to >>> exploit Remote Command Execution, SQL Injection and Code Execution. >> >> I am working on updating the Horde packages in Debian LTS, also >> coordinating with the security team for an update to Debian stable, >> and so some clarification would help. >> >> It is clear that the TagCloud XSS (CVE-2019-12094) was fixed and the >> associated commit was easy to find and applied cleanly to the Horde >> package in Debian. It is also clear that the CSRF (CVE-2019-12095) >> has been deemed minor and not worth fixing. However, it is not clear >> that the "3 different reflected XSS vulnerability" have been >> addressed. Is there an additional vulnerability there beyond those >> two which received CVE assignments? Answering this would help ensure >> that we properly track the state of Horde in Debian. >
Attachment
Watch this ticket