This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-12095 →

DEBIAN-CVE-2019-12095

Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags param...

Original description

The description as published by the source.

Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 php-horde

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.21+debian0-1"}]}]

Debian:12 php-horde-trean

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org