What’s Vulnerable › Vulnerabilities

CVE-2022-26874

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-11 · updated 2026-06-17
• Weakness: CWE-79

Description

lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.

Affected products

• Debian Linux: 9.0, 10.0
• Horde Mime Viewer: before 2.2.4 — fixed in 2.2.4

How to fix

Upgrade to a fixed version: Horde Mime Viewer 2.2.4. Check the vendor advisory for mitigations.

References

• https://blog.sonarsource.com/horde-webmail-account-takeover-via-email/
• https://github.com/horde/Mime_Viewer/commit/02b46cec1a7e8f1a6835b628850cd56b85963bb5
• https://lists.debian.org/debian-lts-announce/2022/06/msg00007.html
• https://lists.debian.org/debian-lts-announce/2022/08/msg00021.html
• https://blog.sonarsource.com/horde-webmail-account-takeover-via-email/
• https://github.com/horde/Mime_Viewer/commit/02b46cec1a7e8f1a6835b628850cd56b85963bb5
• https://lists.debian.org/debian-lts-announce/2022/06/msg00007.html
• https://lists.debian.org/debian-lts-announce/2022/08/msg00021.html
• https://lists.debian.org/debian-lts-announce/2024/10/msg00015.html

Get alerted when CVE-2022-26874 or the next vulnerability affects your stack