{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-04-22T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "51238", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/51238"}, {"name": "FEDORA-2008-3460", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00444.html"}, {"name": "29920", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/29920"}, {"name": "28898", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/28898"}, {"name": "30649", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/30649"}, {"name": "1019934", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1019934"}, {"name": "FEDORA-2008-3543", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00427.html"}, {"name": "20080422 Horde Webmail XSS [Aria-Security]", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/491230/100/0/threaded"}, {"name": "horde-webmail-addevent-xss(41974)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41974"}, {"name": "ADV-2008-1373", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/1373/references"}, {"name": "DSA-1560", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2008/dsa-1560"}, {"name": "3831", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/3831"}, {"tags": ["x_refsource_MISC"], "url": "http://forum.aria-security.com/showthread.php?t=49"}, {"name": "[kronolith] 20080427 Kronolith H3 (2.1.8) (final)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.horde.org/archives/kronolith/Week-of-Mon-20080421/006807.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-1974", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "51238", "refsource": "OSVDB", "url": "http://osvdb.org/51238"}, {"name": "FEDORA-2008-3460", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00444.html"}, {"name": "29920", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/29920"}, {"name": "28898", "refsource": "BID", "url": "http://www.securityfocus.com/bid/28898"}, {"name": "30649", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/30649"}, {"name": "1019934", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1019934"}, {"name": "FEDORA-2008-3543", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00427.html"}, {"name": "20080422 Horde Webmail XSS [Aria-Security]", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/491230/100/0/threaded"}, {"name": "horde-webmail-addevent-xss(41974)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41974"}, {"name": "ADV-2008-1373", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/1373/references"}, {"name": "DSA-1560", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2008/dsa-1560"}, {"name": "3831", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/3831"}, {"name": "http://forum.aria-security.com/showthread.php?t=49", "refsource": "MISC", "url": "http://forum.aria-security.com/showthread.php?t=49"}, {"name": "[kronolith] 20080427 Kronolith H3 (2.1.8) (final)", "refsource": "MLIST", "url": "http://lists.horde.org/archives/kronolith/Week-of-Mon-20080421/006807.html"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-1974", "datePublished": "2008-04-27T19:00:00", "dateReserved": "2008-04-27T00:00:00", "dateUpdated": "2018-10-11T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:horde:groupware:1.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "B3AB0176-9CB3-4D49-B644-2C413C9B6E13", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "842159D1-E30C-4077-8E92-07979E52C10B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de \u00f3rdenes en sitios cruzados (XSS) en addevent.php de Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, y Groupware 1.0.5 permite a atacantes remotos inyectar 'script' web o HTML de su elecci\u00f3n mediante el par\u00e1metro \"url\"."}], "id": "CVE-2008-1974", "lastModified": "2018-10-11T20:38:36.903", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2008-04-27T19:05:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://forum.aria-security.com/showthread.php?t=49"}, {"source": "cve@mitre.org", "url": "http://lists.horde.org/archives/kronolith/Week-of-Mon-20080421/006807.html"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/51238"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/29920"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/30649"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/3831"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/491230/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/28898"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1019934"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2008/1373/references"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41974"}, {"source": "cve@mitre.org", "url": "https://www.debian.org/security/2008/dsa-1560"}, {"source": "cve@mitre.org", "url": "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00427.html"}, {"source": "cve@mitre.org", "url": "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00444.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}