Homepage

Cross-site Scripting (XSS) Affecting php-horde-core package, versions <2.11.1-2ubuntu0.1~esm1

Severity

 Recommended
0.0
medium
0
10

Based on Ubuntu security rating.

Threat Intelligence

EPSS
2.06% (81st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1404-PHPHORDECORE-310107
  • published13 Apr 2016
  • disclosed13 Apr 2016
Report a new vulnerability Found a mistake?

Introduced: 13 Apr 2016

CVE-2015-8807  (opens in a new tab)
CWE-79  (opens in a new tab)

How to fix?

Upgrade Ubuntu:14.04 php-horde-core to version 2.11.1-2ubuntu0.1~esm1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream php-horde-core package and not the php-horde-core package as distributed by Ubuntu. See How to fix? for Ubuntu:14.04 relevant fixed versions and status.

Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.