CVE-2019-12094

Name of the Vulnerable Software and Affected Versions Horde Groupware Webmail Edition versions prior to 5.2.23

Description The issue allows for XSS attacks via specific URI parameters. This can be achieved through the admin/user.php endpoint with either the form=update f or form=remove f parameter and the user name variable, or through the admin/config/diff.php endpoint with the app variable.

Recommendations For Horde Groupware Webmail Edition versions prior to 5.2.23, update to version 5.2.23 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/user.php and admin/config/diff.php endpoints until the update is applied. Avoid using the user name variable in the affected admin/user.php endpoint and the app variable in the admin/config/diff.php endpoint until the issue is resolved.