CVE-2019-12095

Name of the Vulnerable Software and Affected Versions Horde Trean versions prior to 5.2.22

Description The issue allows for CSRF, as demonstrated by the treanBookmarkTags parameter to the "trean/" URI on a webmail server. It is noted that treanBookmarkTags could potentially be a stored XSS payload.

Recommendations For versions prior to 5.2.22, consider restricting access to the "trean/" URI to minimize the risk of exploitation. As a temporary workaround, avoid using the treanBookmarkTags parameter in the affected API endpoint until the issue is resolved.