Every CVE Search/ Get API key

CVE-2012-0791

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde...

4.3 MediumFix available

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.

Exploit likelihood

2.35%Up 0.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.

Record
CVE-2012-0791
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.

Record
CVE-2012-0791
Updated
2026-11-02
EUVDEUVD-2012-0822 No score

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.

Record
EUVD-2012-0822
Updated
2026-11-03
GitHub AdvisoriesGHSA-2j7j-jvr9-h35r No score

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde...

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.

Record
GHSA-2j7j-jvr9-h35r
Weakness
CWE-79
Updated
2026-11-02
OSVopenSUSE-SU-2024:10191-1 No score

horde5-imp-6.2.5-1.2 on GA media

These are all security issues fixed in the horde5-imp-6.2.5-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10191-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
imp4
Debian:6.0
 before 4.3.7+debian0-2.2
4.3.7+debian0-2.2
horde5-imp
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 6.2.5-1.2
6.2.5-1.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-0791 is a medium vulnerability (CVSS 4.3) in Horde Groupware Webmail Edition, published January 24, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.35%, the 83rd percentile. Fixed in imp4 4.3.7+debian0-2.2.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open