{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-11-14T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month, (2) monthlist, or (3) prevmonthlist fields, related to portal blocks."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-04-05T19:57:00", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES"}, {"name": "openSUSE-SU-2012:1625", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html"}, {"name": "[oss-security] 20121123 CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/11/23/3"}, {"name": "[oss-security] 20121123 Re: CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/11/23/7"}, {"name": "51233", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/51233"}, {"name": "[announce] 20121114 Kronolith H4 (3.0.18) (final)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.horde.org/archives/announce/2012/000836.html"}, {"name": "51469", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/51469"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=879684"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e"}, {"name": "56541", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/56541"}, {"name": "87345", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/87345"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2012-5567", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month, (2) monthlist, or (3) prevmonthlist fields, related to portal blocks."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES", "refsource": "CONFIRM", "url": "https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES"}, {"name": "openSUSE-SU-2012:1625", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html"}, {"name": "[oss-security] 20121123 CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2012/11/23/3"}, {"name": "[oss-security] 20121123 Re: CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2012/11/23/7"}, {"name": "51233", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/51233"}, {"name": "[announce] 20121114 Kronolith H4 (3.0.18) (final)", "refsource": "MLIST", "url": "http://lists.horde.org/archives/announce/2012/000836.html"}, {"name": "51469", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/51469"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=879684", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=879684"}, {"name": "http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e", "refsource": "CONFIRM", "url": "http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e"}, {"name": "56541", "refsource": "BID", "url": "http://www.securityfocus.com/bid/56541"}, {"name": "87345", "refsource": "OSVDB", "url": "http://www.osvdb.org/87345"}]}}}}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-5567", "datePublished": "2014-04-05T21:00:00", "dateReserved": "2012-10-24T00:00:00", "dateUpdated": "2014-04-05T19:57:00", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:horde:groupware:*:*:webamail:*:*:*:*:*", "matchCriteriaId": "E888C8C2-27C5-4BD0-9EEE-750DF5DE6488", "versionEndIncluding": "4.0.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:groupware:4.0:*:webamail:*:*:*:*:*", "matchCriteriaId": "F505E80A-B91C-401C-9B77-F34B00ECA434", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:groupware:4.0:rc1:webamail:*:*:*:*:*", "matchCriteriaId": "A9129D4A-F365-4630-976A-DBFBBEA531FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:groupware:4.0:rc2:webamail:*:*:*:*:*", "matchCriteriaId": "C910D464-66B3-4593-A7D8-3FD3EADB9AFE", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:groupware:4.0.1:*:webamail:*:*:*:*:*", "matchCriteriaId": "A6A67FDD-C9CE-43E4-ADD9-DB5699BEF61C", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:groupware:4.0.2:*:webamail:*:*:*:*:*", "matchCriteriaId": "A1158FCA-2AAB-4EC4-9B34-F1B44DDA4FA9", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:groupware:4.0.3:*:webamail:*:*:*:*:*", "matchCriteriaId": "2A0A5DB9-3731-466D-8D0F-7BE71A34184B", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:groupware:4.0.4:*:webamail:*:*:*:*:*", "matchCriteriaId": "5D07339E-54B9-4513-82EB-0FB53AD5B82B", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:groupware:4.0.5:*:webamail:*:*:*:*:*", "matchCriteriaId": "717CB664-818F-4583-83FF-47B167993569", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:groupware:4.0.6:*:webamail:*:*:*:*:*", "matchCriteriaId": "185839EF-1F07-4C2C-B710-FD607EAD0A71", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:groupware:4.0.7:*:webamail:*:*:*:*:*", "matchCriteriaId": "29D96163-C022-4DBD-8B94-746665B99A73", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:horde:kronolith_h4:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF9C1B7C-8DE5-4925-9651-9204FB96667B", "versionEndIncluding": "3.0.17", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "F75CC603-45D1-4FAB-8E4D-B5CF7F6FC99A", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "C3C905F8-1A2F-46A4-AD0F-9118AC3CC16D", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "B60EDA48-5703-4A6D-906D-8BB833B3CC34", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "B887A9E9-C8D2-4622-A4E8-A39E5DCD0301", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "BD8032AE-F6E0-498C-A473-B1215DD4FF25", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "1823C3C8-3C94-4991-9ADE-7D966093F2C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "1E5535C3-442C-41C1-9EDD-BC5FA23C9E80", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "5F4111B8-1AC2-4C36-8366-1E70FDA8EF49", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "5CEEE7D7-13BA-4F25-8E82-00F59CA52CD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "4D2EAFA0-CC18-4B73-B72F-A467AEE62803", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "8007A3CC-5916-42A9-9892-969A3BC49E7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "5581E8B0-344B-41DB-9892-F4F36324E743", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "7E82DBE7-5230-45A8-B6E7-2C73B1867134", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "02646219-43E5-4912-B003-F6556582C399", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "54D4B84A-713E-4918-AB12-603D300901FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.11:*:*:*:*:*:*:*", "matchCriteriaId": "B804D928-5962-4C23-93FE-532E58891B43", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.12:*:*:*:*:*:*:*", "matchCriteriaId": "ABC86F11-5EED-4BB3-A53C-D3749103EF1C", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.13:*:*:*:*:*:*:*", "matchCriteriaId": "AB1D4DCE-A86A-4155-A249-2BB5B875A934", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.14:*:*:*:*:*:*:*", "matchCriteriaId": "E54F5C8A-7E89-4C80-9228-BCB121D8DA6C", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.15:*:*:*:*:*:*:*", "matchCriteriaId": "25BE11AE-6988-4754-9102-4704707F6182", "vulnerable": true}, {"criteria": "cpe:2.3:a:horde:kronolith_h4:3.0.16:*:*:*:*:*:*:*", "matchCriteriaId": "8BD48168-FCC7-49C4-AC41-3E55DCF62702", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month, (2) monthlist, or (3) prevmonthlist fields, related to portal blocks."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de XSS en la aplicaci\u00f3n de calendario de Horde Kronolith H4 anterior a 3.0.18, utilizado en Horde Groupware Webmail Edition anterior a 4.0.9, permiten a atacantes remotos inyectar script Web o HTML arbitrarios a trav\u00e9s de par\u00e1metros de localizaci\u00f3n de evento manipulados en los campos (1) month, (2) monthlist o (3) prevmonthlist, relacionado con bloques de portales."}], "id": "CVE-2012-5567", "lastModified": "2014-04-07T15:32:22.280", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2014-04-05T21:55:06.300", "references": [{"source": "secalert@redhat.com", "url": "http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e"}, {"source": "secalert@redhat.com", "url": "http://lists.horde.org/archives/announce/2012/000836.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/51233"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/51469"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/11/23/3"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/11/23/7"}, {"source": "secalert@redhat.com", "url": "http://www.osvdb.org/87345"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/56541"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=879684"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}