CVE-2019-12095
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows...
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.
- Record
CVE-2019-12095- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-79, CWE-352
- Updated
- 2026-11-02
CVE List No score
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.
- Record
CVE-2019-12095- Updated
- 2026-11-02
EUVDEUVD-2019-3747 No score
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.
- Record
EUVD-2019-3747- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-35fh-vqwm-xx6m No score
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows...
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server.
- Record
GHSA-35fh-vqwm-xx6m- Updated
- 2026-11-02
OSV
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.
- Record
CVE-2019-12095- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12095
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.
- Record
DEBIAN-CVE-2019-12095- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12095
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.
- Record
UBUNTU-CVE-2019-12095- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php-hordeDebian:12 |
before 5.2.21+debian0-1 | 5.2.21+debian0-1 |
php-horde-treanDebian:12 |
All versions, plus listed versions 1.1.10-3 |
None known |
php-hordeDebian:8 |
before 5.2.1+debian0-2+deb8u5, plus listed versions 5.2.1+debian0-2+deb8u15.2.1+debian0-2+deb8u25.2.1+debian0-2+deb8u35.2.1+debian0-2+deb8u4 |
5.2.1+debian0-2+deb8u5 |
php-hordeUbuntu:16.04:LTS |
All versions, plus listed versions 5.2.7+debian0-15.2.8+debian0-15.2.9+debian0-15.2.9+debian0-1build1 |
None known |
php-horde-treanUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.2-11.1.3-11.1.4-11.1.4-1build1 |
None known |
php-hordeUbuntu:18.04:LTS |
All versions, plus listed versions 5.2.16+debian0-15.2.17+debian0-1 |
None known |
php-horde-treanUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.8-11.1.9-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12095 is a high vulnerability (CVSS 8.8) in Horde Groupware, published October 24, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in php-horde 5.2.21+debian0-1.
References
numanozdemir.com/respdisc/horde/horde.mp4
packetstormsecurity.com/files/152975/Horde-Webmail-5.2.22-XSS-CSRF-SQL-Injection-Code-Execution.html
exploit-db.com/exploits/46903
cxsecurity.com/issue/WLB-2019050199
exchange.xforce.ibmcloud.com/vulnerabilities/161333