Stored XSS Vulnerability in Horde Groupware Webmail Edition (CVE-2020-8035)
Summary
CVE-2020-8035: The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. Affects php-horde across 3 version ranges.
< 5.2.23+debian0-1
< cf488bd4e87e1ff0d9e11a5a3c2d2f805172dd70
< da4d701808c3af4100bd1f2d7f0fd07854267fa9
Fixed in 5.2.23+debian0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Horde Groupware Webmail Edition is an open-source web-based email client that allows users to manage their email, calendar, and contacts. It is widely used for its flexibility and integration capabilities with various web services. However, prior to version 5.2.22, it was found to be vulnerable to a stored Cross-Site Scripting (XSS) attack, which could compromise user accounts through malicious SVG image uploads.
Vulnerability Detail
The vulnerability arises from the image view functionality in Horde Groupware Webmail Edition, where an attacker can upload an SVG image containing a JavaScript payload. When a victim accesses the malicious URL, the script executes in their browser, potentially allowing the attacker to gain unauthorized access to the victim's webmail account. This stored XSS vulnerability can lead to severe consequences, including data theft and unauthorized actions performed on behalf of the victim.
How To Fix
Minimum fixed version
5.2.23+debian0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-hordeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the image upload functionality or restrict the types of files that can be uploaded to prevent SVG files from being processed until the software is updated.
Conclusion
CVE-2020-8035 represents a significant security risk for users of Horde Groupware Webmail Edition prior to version 5.2.22. It is crucial for users to upgrade their software to mitigate this vulnerability and protect their accounts from potential attacks.
See every vulnerability recorded for php-horde →
FAQ
CVE-2020-8035 is a stored XSS vulnerability found in Horde Groupware Webmail Edition that allows attackers to execute JavaScript in the context of a user's browser.
If you are using Horde Groupware Webmail Edition version prior to 5.2.22, your installation is vulnerable to this issue.
The risks include unauthorized access to user accounts, data theft, and the potential for attackers to perform actions on behalf of the victim.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities using just a manifest file like package-lock.json. You can check your application at Vulert Scanner.
The CVSS score for CVE-2020-8035 is 6.1, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for php-horde.
