This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-8034 →

DEBIAN-CVE-2020-8034

Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vuln...

Original description

The description as published by the source.

Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 php-horde-gollem

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-6"}]}]

References

advisory security-tracker.debian.org