VulnerabilityModified

CVE-2012-0791

MEDIUM 4.3EPSS 2.35%

Does this matter?

Lower severity and a low EPSS score (2.35%). Track it; it rarely justifies an emergency change on its own.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 2.35% probability · 83th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: horde/dynamic imp · horde/imp · horde/groupware webmail edition
Source: secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.