Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Horde webmail lets attackers run malicious scripts

CVE-2014-4946 · published 12 years ago
Summary

The Horde email and groupware web interface (versions before 6.1.8 for IMP and before 5.1.5 for the Groupware edition) can be tricked into executing code that an attacker supplies. This could allow a remote attacker to display fake pages, steal login credentials, or perform actions as the logged‑in user. Apply the latest software updates or patches provided by Horde to close the issue.

What to do
  • Update debian php-horde-imp to version 6.2.0-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian php-horde-imp < 6.2.0-1
Fix: upgrade to 6.2.0-1
– horde groupware <= 5.1.4
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
cpe:2.3:a:horde:groupware:*:*:*:*:webmail:*:*:*
– horde internet_mail_program <= 6.1.7
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.1.0
6.1.1
6.1.2
6.1.3
3 more version ranges
cpe:2.3:a:horde:internet_mail_program:*:*:*:*:*:*:*:*
Original advisory text
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbi...
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.
References
Severity
4.3 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published14 Jul 2014
Updated4 Nov 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2014-4946 · OSV
CVE-2014-4946 · NVD
Track software like this
Free during beta