What’s Vulnerable › Vulnerabilities

CVE-2020-8034

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-05-18 · updated 2026-06-17
• Weakness: CWE-79

Description

Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.

Affected products

• Horde Gollem: before 3.0.13 — fixed in 3.0.13
• Horde Groupware: 5.2.22

How to fix

Upgrade to a fixed version: Horde Gollem 3.0.13. Check the vendor advisory for mitigations.

References

• https://github.com/horde/gollem/blob/95b2a4212d734f1b27aaa7a221d2fa1370d2631f/docs/CHANGES
• https://github.com/horde/gollem/commits/master
• https://lists.debian.org/debian-lts-announce/2020/05/msg00033.html
• https://lists.horde.org/archives/announce/2020/001289.html
• https://lists.horde.org/archives/gollem/Week-of-Mon-20200420/001990.html
• https://github.com/horde/gollem/blob/95b2a4212d734f1b27aaa7a221d2fa1370d2631f/docs/CHANGES
• https://github.com/horde/gollem/commits/master
• https://lists.debian.org/debian-lts-announce/2020/05/msg00033.html
• https://lists.horde.org/archives/announce/2020/001289.html
• https://lists.horde.org/archives/gollem/Week-of-Mon-20200420/001990.html

Get alerted when CVE-2020-8034 or the next vulnerability affects your stack