CVE-2022-26874

Description

lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.

Reserved 2022-03-11 | Published 2022-03-11 | Updated 2024-10-19 | Assigner mitre

References

blog.sonarsource.com/...-webmail-account-takeover-via-email/

github.com/...ommit/02b46cec1a7e8f1a6835b628850cd56b85963bb5

lists.debian.org/debian-lts-announce/2022/06/msg00007.html ([debian-lts-announce] 20220606 [SECURITY] [DLA 3045-1] php-horde-mime-viewer security update) mailing-list

lists.debian.org/debian-lts-announce/2022/08/msg00021.html ([debian-lts-announce] 20220831 [SECURITY] [DLA 3089-1] php-horde-mime-viewer security update) mailing-list

cve.org (CVE-2022-26874)

nvd.nist.gov (CVE-2022-26874)

Download JSON