← All advisories

Medium severity5.4NVD Advisory· Published Nov 20, 2017· Updated Jun 17, 2026

CVE-2017-16906

CVE-2017-16906

Description

In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar -> New Event" action.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

Horde (software)/Groupware2 versions
cpe:2.3:a:horde:groupware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:horde:groupware:*:*:*:*:*:*:*:*range: >=5.2.19,<=5.2.22
- (no CPE)range: 5.2.19-5.2.22

Patches

Vulnerability mechanics

References

4

github.com/horde/kronolith/commit/09d90141292f9ec516a7a2007bf828ce2bbdf60dnvdPatchThird Party Advisory
code610.blogspot.com/2017/11/rce-via-xss-horde-5219.htmlnvdExploitIssue TrackingThird Party Advisory
github.com/starnightcyber/Miscellaneous/blob/master/Horde/README.mdnvdExploitThird Party Advisory
lists.debian.org/debian-lts-announce/2020/08/msg00049.htmlnvd

News mentions

0

No linked articles in our index yet.