CVE-2012-5566

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-04-05 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote attackers to inject arbitrary web script or HTML via the (1) tasks view or (2) search view.

Affected products

Horde Groupware: through 4.0.7; 4.0, 4.0-rc1, 4.0-rc2, 4.0.1, 4.0.2, 4.0.3 (+3)
Horde Kronolith H4: through 3.0.16; 3.0, 3.0-alpha1, 3.0-beta1, 3.0-rc1, 3.0-rc2, 3.0.1 (+14)

References

http://bugs.horde.org/ticket/11189
http://git.horde.org/horde-git/-/commit/1228a6825a8dab3333d0a8c8986fc10d1f3d11b2
http://lists.horde.org/archives/announce/2012/000773.html
http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html
http://secunia.com/advisories/51469
http://securitytracker.com/id?1027106
http://www.openwall.com/lists/oss-security/2012/11/23/3
http://www.openwall.com/lists/oss-security/2012/11/23/7
http://www.osvdb.org/82371
http://www.osvdb.org/82382
http://www.securityfocus.com/bid/56541
https://github.com/horde/horde/blob/master/kronolith/docs/CHANGES

Get alerted when CVE-2012-5566 or the next vulnerability affects your stack