XSS Vulnerability in Horde Groupware: php-horde and php-horde-core
Summary
CVE-2017-16907: In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action. Affects php-horde across 6 version ranges.
< 5.2.18+debian0-1
< 87b6ef2c1f8af1d80ad4e7ac182bd7b3341d45ae
< 861c2461b4c16a64383cfe4daa89eba79dff541a
< 801083b02b92b8ba6710471253ecf4b36943c80d
< 943774c44518b50ad321bec160d4f8a3c04cbadb
< fb2113bbcd04bd4a28c46aad0889fb0a3979a230
Fixed in 5.2.18+debian0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Horde Groupware is a web-based application suite that provides a range of functionalities including email, calendar, task management, and more. It is built using PHP and is designed to be modular, allowing users to customize their experience. The affected packages, php-horde and php-horde-core, are integral components of this suite, facilitating core functionalities and user interactions. This vulnerability exposes users to cross-site scripting (XSS) attacks, which can compromise user data and application integrity.
Vulnerability Detail
The vulnerability, identified as CVE-2017-16907, arises from improper handling of user input in the Color field during the Create Task List action. An attacker can exploit this flaw by injecting malicious scripts into the Color field, which may then be executed in the context of another user's session. This can lead to unauthorized actions, data theft, or further exploitation of the application. The vulnerability affects multiple versions of the php-horde and php-horde-core packages, specifically those prior to the fixed versions.
How To Fix
Minimum fixed version
5.2.18+debian0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-hordeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can sanitize inputs in the Color field to prevent script injection. This can be done by implementing input validation and escaping any potentially harmful characters before processing the input.
Conclusion
CVE-2017-16907 is a significant XSS vulnerability affecting Horde Groupware's php-horde and php-horde-core packages. Users are strongly advised to update their packages to the latest versions to protect against potential exploits. Additionally, implementing input validation can serve as a temporary workaround until updates are applied.
See every vulnerability recorded for php-horde →
FAQ
CVE-2017-16907 is a cross-site scripting (XSS) vulnerability found in Horde Groupware that allows attackers to inject malicious scripts through the Color field in the Create Task List action.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access, data theft, and potentially allow attackers to perform actions on behalf of other users.
The CVSS score for CVE-2017-16907 is 5.4, indicating a moderate severity level.
If immediate updates are not possible, implement input validation and sanitization as a temporary measure to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for php-horde.
