Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter.

- Bug #444400 - CVE-2008-1974 kronolith: XSS in     addevent.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Apr 30 2008 Jan ONDREJ (SAL) <ondrejj(at)salstar.sk>     2.1.8-1

    - Upgraded to 2.1.8: Fixed XSS in the add event screen.
      Added Turkish translation.

  - Mon Jan 14 2008 Brandon Holbrook <fedora at     theholbrooks.org> 2.1.7-1

    - Upgraded to 2.1.7

    - Sat Oct 20 2007 Brandon Holbrook <fedora at       theholbrooks.org> 2.1.6-1

    - Upgraded to 2.1.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

'The-0utl4w' discovered that the Kronolith, calendar component for the Horde Framework, didn't properly sanitise URL input, leading to a cross-site scripting vulnerability in the add event screen.

ID	Name	Product	Family	Severity
33144	Fedora 8 : kronolith-2.1.8-1.fc8 (2008-3543)	Nessus	Fedora Local Security Checks	medium
33143	Fedora 7 : kronolith-2.1.8-1.fc7 (2008-3460)	Nessus	Fedora Local Security Checks	medium
32084	Debian DSA-1560-1 : kronolith2 - insufficient input sanitising	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2008-1974

medium

Tenable Plugins

medium

medium

medium