CVE-2008-1974

medium

Description

Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter.

References

https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00444.html

https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00427.html

https://www.debian.org/security/2008/dsa-1560

https://exchange.xforce.ibmcloud.com/vulnerabilities/41974

https://euvd.enisa.europa.eu/vulnerability/EUVD-2008-1972

http://www.vupen.com/english/advisories/2008/1373/references

http://www.securitytracker.com/id?1019934

http://www.securityfocus.com/bid/28898

http://www.securityfocus.com/archive/1/491230/100/0/threaded

http://securityreason.com/securityalert/3831

http://secunia.com/advisories/30649

http://secunia.com/advisories/29920

http://osvdb.org/51238

http://lists.horde.org/archives/kronolith/Week-of-Mon-20080421/006807.html

http://forum.aria-security.com/showthread.php?t=49

Details

Source: Mitre, NVD

Published: 2008-04-27

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N