Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web…

Published 19 y ago 2007-03-26 · modified 4 mo ago 2026-06-16 · JSON

CVSS

5.4

v3.1 · CNA

CISA KEV

not known exploited

EPSS

1.0%

percentile 62%

Public exploits

none known

Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in (1) imp/search.php and (2) ingo/rule.php. NOTE: this issue has been disputed by the vendor, noting that the search.php issue was resolved in CVE-2006-4255, and attackers can only use rule.php to inject XSS into their own pages

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago 2024-04-15

Exploit prediction (EPSS)

0.96% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
CNA	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

exchange.xforce.ibmcloud.com /vulnerabilities/33228 · vdb-entry, x_refsource_XF, x_transferred
securityfocus.com /archive/1/463819/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
securityreason.com /securityalert/2487 · third-party-advisory, x_refsource_SREASON, x_transferred
securityfocus.com /bid/23136 · vdb-entry, x_refsource_BID, x_transferred
securityfocus.com /archive/1/463911/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

CVE List: CVE-2007-1679
NVD: CVE-2007-1679

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.