CVE-2020-8035
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a...
CVE-2020-8035 is a medium vulnerability (CVSS 6.1) in Horde Groupware, published May 18, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in php-horde 5.2.23+debian0-1.
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
- Record
CVE-2020-8035- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
- Record
CVE-2020-8035- Updated
- 2026-11-02
EUVDEUVD-2020-28947 No score
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
- Record
EUVD-2020-28947- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7gcr-rp9v-fqcf No score
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a...
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
- Record
GHSA-7gcr-rp9v-fqcf- Updated
- 2026-11-02
OSV
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
- Record
CVE-2020-8035- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-8035
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
- Record
DEBIAN-CVE-2020-8035- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-8035
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
- Record
UBUNTU-CVE-2020-8035- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php-hordeDebian:12 |
before 5.2.23+debian0-1 | 5.2.23+debian0-1 |
php-hordeDebian:8 |
before 5.2.1+debian0-2+deb8u6, plus listed versions 5.2.1+debian0-2+deb8u15.2.1+debian0-2+deb8u25.2.1+debian0-2+deb8u35.2.1+debian0-2+deb8u45.2.1+debian0-2+deb8u5 |
5.2.1+debian0-2+deb8u6 |
php-hordeUbuntu:16.04:LTS |
All versions, plus listed versions 5.2.7+debian0-15.2.8+debian0-15.2.9+debian0-15.2.9+debian0-1build1 |
None known |
php-hordeUbuntu:18.04:LTS |
All versions, plus listed versions 5.2.16+debian0-15.2.17+debian0-1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.horde.org/archives/announce/2020/001290.html
github.com/horde/base/blob/c00f2fdb222055fb2ccb6d53b5b5240c0a7d2a75/docs/CHANGES
lists.debian.org/debian-lts-announce/2020/05/msg00035.html
nvd.nist.gov/vuln/detail/CVE-2020-8035
security-tracker.debian.org/tracker/CVE-2020-8035
ubuntu.com/security/CVE-2020-8035
cve.org/CVERecord?id=CVE-2020-8035