Bug 1515688 (CVE-2017-16906, CVE-2017-16907, CVE-2017-16908)

Summary: CVE-2017-16906 CVE-2017-16907 CVE-2017-16908 php-horde-horde: Multiple vulnerabilities
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: fedora
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-11-21 09:20:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1515690, 1515691    
Bug Blocks:    

Description Andrej Nemec 2017-11-21 08:59:09 UTC

In Horde Groupware 5.2.19, there is XSS via the URL field in a "Calendar -> New Event" action.


In Horde Groupware 5.2.19, there is XSS via the Color field in a Create Task List action.


In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed.



Comment 1 Andrej Nemec 2017-11-21 09:00:06 UTC
Created php-horde-horde tracking bugs for this issue:

Affects: epel-all [bug 1515690]
Affects: fedora-all [bug 1515691]

Comment 2 Remi Collet 2017-11-21 09:06:05 UTC
php-horde-horde is NOT Horde Groupware.