CVE-2020-8035

Name of the Vulnerable Software and Affected Versions Horde Groupware Webmail Edition versions prior to 5.2.22

Description The image view functionality is affected by a stored Cross-Site Scripting (XSS) issue via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.

Recommendations For versions prior to 5.2.22, update to version 5.2.22 or later to resolve the issue. As a temporary workaround, consider restricting the upload of SVG images to prevent potential exploitation.