QwikSec

Security Database

CVE

CWE

Training

CVE-2017-16908

Published: Nov 20, 2017

Modified: Aug 5, 2024

PUBLISHED

Description

In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://code610.blogspot.com/2017/11/rce-via-xss-horde-5219.html

x_refsource_MISC

https://github.com/horde/kronolith/commit/39f740068ad21618f6f70b6e37855c61cadbd716

x_refsource_CONFIRM

[debian-lts-announce] 20200829 [SECURITY] [DLA 2350-1] php-horde-kronolith security update

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.