GHSA-qfg7-wc25-r3j2

ghsaUSosv

eGroupware Community Edition Stored XSS vulnerability

view advisory published 2022-05-17Licence: CC-BY-4.0

Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the application administrator.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-14920US	medium6.1	1.12% (66th)	—	2017-09-30
Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which i…

references

External citations — patches, advisories, analysis.

http://openwall.com/lists/oss-security/2017/09/28/12WEB
https://github.com/EGroupware/egroupwarePACKAGE
https://github.com/EGroupware/egroupware/commit/0ececf8c78f1c3f9ba15465f53a682dd7d89529fWEB
https://nvd.nist.gov/vuln/detail/CVE-2017-14920ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan