CVE-2021-26929

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used)

published February 14, 2021

CVSS
—
EPSS
5%
Percentile
92.1
In the wild
Unconfirmed
What it is

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke use of \x00\x00\x00 and \x01\x01\x01 interferes with XSS defenses.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04944 · 92.1th percentile
Published
2021-02-14T03:43Z
EPSS history
Timeline
  • 14 FEB 03:43Z
    An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used)
    cvelistv5