CVE-2016-2228

Name of the Vulnerable Software and Affected Versions Horde Groupware versions prior to 5.2.12 Horde Groupware Webmail Edition versions prior to 5.2.12

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter. This can be demonstrated by a request to "xplorer/gollem/manager.php".

Recommendations For Horde Groupware versions prior to 5.2.12, update to version 5.2.12 or later. For Horde Groupware Webmail Edition versions prior to 5.2.12, update to version 5.2.12 or later. As a temporary workaround, consider restricting access to the searchfield parameter in the affected API endpoint until a patch is available.