CVE-2015-8807

Description

Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.

References

https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253

http://www.openwall.com/lists/oss-security/2016/02/06/5

http://www.openwall.com/lists/oss-security/2016/02/06/4

http://www.debian.org/security/2016/dsa-3496

http://lists.horde.org/archives/announce/2016/001149.html

http://lists.horde.org/archives/announce/2016/001148.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3