製品・ソフトウェアに関する情報

JVN脆弱性詳細

Horde Groupware および Groupware Webmail Edition におけるクロスサイトスクリプティングの脆弱性

Title	Horde Groupware および Groupware Webmail Edition におけるクロスサイトスクリプティングの脆弱性
Summary	Horde Groupware および Groupware Webmail Edition の horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php の _renderVarInput_number 関数には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	第三者により、数値形式のフィールドに関する問題によって、任意の Web スクリプトまたは HTML を挿入される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 14, 2015, midnight
Registration Date	April 21, 2016, 4:09 p.m.
Last Update	April 21, 2016, 4:09 p.m.

Affected System

Debian

Debian GNU/Linux 8.0

Fedora Project

Fedora 22

Fedora 23

Horde

Horde Groupware 5.2.12 未満

Horde Groupware Webmail Edition 5.2.12 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-8807	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8807
National Vulnerability Database (NVD)
2	CVE-2015-8807	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8807

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-3496	https://www.debian.org/security/2016/dsa-3496
Fedora Update Notification
2	FEDORA-2016-3d1183830b	https://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.html
3	FEDORA-2016-5d0e7f15ef	https://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.html
GitHub
4	Escape form value.	https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253
5	Released webmail-5.2.12	https://github.com/horde/horde/blob/e838d4c800b0d1ecaf8b4cc613fd3af4f994c79c/bundles/webmail/docs/CHANGES
Horde
6	[announce] [SECURITY] Horde Groupware 5.2.12 (final)	http://lists.horde.org/archives/announce/2016/001148.html
7	[announce] [SECURITY] Horde Groupware Webmail Edition 5.2.12 (final)	http://lists.horde.org/archives/announce/2016/001149.html

Change Log

No	Changed Details	Date of change
0	[2016年04月21日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2015-8807

Summary	Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.
Publication Date	April 14, 2016, 1:59 a.m.
Registration Date	Jan. 26, 2021, 2:59 p.m.
Last Update	Nov. 21, 2024, 11:39 a.m.

Affected software configurations

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:horde:groupware:5.2.11:::::::*
cpe:2.3:a:horde:groupware:5.2.11::::webmail:::

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.html
2	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.html
3	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.html
4	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.html
5	http://lists.horde.org/archives/announce/2016/001148.html	Vendor Advisory
6	http://lists.horde.org/archives/announce/2016/001148.html	Vendor Advisory
7	http://lists.horde.org/archives/announce/2016/001149.html	Vendor Advisory
8	http://lists.horde.org/archives/announce/2016/001149.html	Vendor Advisory
9	http://www.debian.org/security/2016/dsa-3496
10	http://www.debian.org/security/2016/dsa-3496
11	http://www.openwall.com/lists/oss-security/2016/02/06/4
12	http://www.openwall.com/lists/oss-security/2016/02/06/4
13	http://www.openwall.com/lists/oss-security/2016/02/06/5
14	http://www.openwall.com/lists/oss-security/2016/02/06/5
15	https://github.com/horde/horde/blob/e838d4c800b0d1ecaf8b4cc613fd3af4f994c79c/bundles/webmail/docs/CHANGES	Exploit
16	https://github.com/horde/horde/blob/e838d4c800b0d1ecaf8b4cc613fd3af4f994c79c/bundles/webmail/docs/CHANGES	Exploit
17	https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253
18	https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html