Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2019-12095 →

DEBIAN-CVE-2019-12095

Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags param...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 php-horde

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.21+debian0-1"}]}]

Debian:12 php-horde-trean

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Références

advisory security-tracker.debian.org