{"id":"CVE-2025-30349","aliases":["DEBIAN-CVE-2025-30349","DLA-4113-1","EUVD-2025-7227","GHSA-mchq-vv84-m9gr","UBUNTU-CVE-2025-30349"],"status":"published","title":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS...","description":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.31292,"percentile":0.98299,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2025-03-21T00:00:00Z","modified":"2026-10-28T02:30:30Z","exploits":[{"source":"pocgithub","id":"natasaka/CVE-2025-30349","title":"natasaka/CVE-2025-30349","date":"2025-03-27","url":"https://github.com/natasaka/CVE-2025-30349"}],"fixes":[{"ecosystem":"Debian:11","package":"php-horde-imp","fixed_in":["6.2.27-2+deb11u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"php-horde-imp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.27-3","6.2.27-3.1"]},{"source":"osv","ecosystem":"Debian:11","package":"php-horde-imp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.27-2+deb11u1"}]}],"versions":["6.2.27-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php-horde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.7+debian0-1","5.2.8+debian0-1","5.2.9+debian0-1","5.2.9+debian0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php-horde-imp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.10-1","6.2.11-1","6.2.12-1","6.2.12-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php-horde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.16+debian0-1","5.2.17+debian0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php-horde-imp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.20-1","6.2.21-1","6.2.21-1ubuntu1"]}],"products":[{"vendor":"horde","product":"imp"}],"references":[{"url":"https://github.com/horde/webmail/releases/tag/v5.2.22","tags":["web"]},{"url":"https://www.horde.org/apps/imp","tags":["web"]},{"url":"https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html","tags":["web"]},{"url":"https://web.archive.org/web/20250321152616/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html","tags":["web","report"]},{"url":"https://www.horde.org/download/horde","tags":["web"]},{"url":"https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L61-L62","tags":["web"]},{"url":"https://www.horde.org/apps/horde","tags":["web"]},{"url":"https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L23-L25","tags":["web"]},{"url":"https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html","tags":["web"]},{"url":"https://github.com/horde/imp/releases/tag/v6.2.27","tags":["web"]},{"url":"https://github.com/horde/base/releases/tag/v5.2.23","tags":["web"]},{"url":"https://web.archive.org/web/20250321162434/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html","tags":["web","report"]},{"url":"https://github.com/natasaka/CVE-2025-30349/","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00008.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30349","tags":["advisory"]},{"url":"https://github.com/natasaka/CVE-2025-30349"},{"url":"https://github.com/advisories/GHSA-mchq-vv84-m9gr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30349.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-30349","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-30349","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30349","tags":["report"]},{"url":"https://github.com/horde/imp/pull/15/","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-30349","description":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.","status":"published","published":"2025-03-21T00:00:00Z","modified":"2025-04-03T19:57:27.039Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:35.418416Z"}],"euvd":[{"id":"EUVD-2025-7227","description":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.","status":"published","published":"2025-03-21T00:00:00Z","modified":"2025-04-03T19:57:27Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:42.939917Z"}],"ghsa":[{"id":"GHSA-mchq-vv84-m9gr","title":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS...","description":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.","status":"published","published":"2025-03-21T18:31:35Z","modified":"2025-04-03T12:30:24Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:00:46.592062Z"}],"nvd":[{"id":"CVE-2025-30349","description":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.","status":"published","published":"2025-03-21T17:15:40.853Z","modified":"2026-06-17T09:08:33.55Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"CVE-2025-30349","description":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.","status":"published","published":"2025-03-21T00:00:00Z","modified":"2026-10-28T02:30:30.173914772Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-30349","description":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.","status":"published","published":"2025-03-21T17:15:40.853Z","modified":"2026-09-01T20:05:45.512784162Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"UBUNTU-CVE-2025-30349","description":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.","status":"published","published":"2025-03-21T17:15:00Z","modified":"2025-10-24T05:18:10Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"DLA-4113-1","title":"php-horde-imp - security update","status":"published","published":"2025-04-03T00:00:00Z","modified":"2026-03-09T02:10:22.669623Z","updated_at":"2026-11-02T15:46:12.7027Z"}]}}