CVE-2022-26874

Katalog CVE

CVSS 5.4 · Medium EPSS 1,1%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada horde mime viewer, debian linux. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.

Rincian

Terbit di NVD

11 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/horde/Mime_Viewer/commit/02b46cec1a7e8f1a6835b628850cd56b85963bb5 patch · advisory pihak ketiga
• https://blog.sonarsource.com/horde-webmail-account-takeover-via-email/ exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/06/msg00007.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/08/msg00021.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/10/msg00015.html