CVE-2008-1974

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-04-27 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter.

Affected products

Horde Groupware: 1.0.5
Horde Groupware Webmail Edition: 1.0.6

References

http://forum.aria-security.com/showthread.php?t=49
http://lists.horde.org/archives/kronolith/Week-of-Mon-20080421/006807.html
http://osvdb.org/51238
http://secunia.com/advisories/29920
http://secunia.com/advisories/30649
http://securityreason.com/securityalert/3831
http://www.securityfocus.com/archive/1/491230/100/0/threaded
http://www.securityfocus.com/bid/28898
http://www.securitytracker.com/id?1019934
http://www.vupen.com/english/advisories/2008/1373/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/41974
https://www.debian.org/security/2008/dsa-1560

Get alerted when CVE-2008-1974 or the next vulnerability affects your stack