Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.01047
Percentile: 0.76573

CVSS Scoring

Affected Products

• cpe:2.3:a:horde:imp:2.0:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:2.2:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:2.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:2.2.2:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:2.2.3:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:2.2.4:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:2.2.5:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:2.2.6:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:2.2.7:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:2.2.8:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:2.3:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:3.0:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:3.1:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:3.1.2:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:3.2:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:3.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:3.2.2:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:3.2.3:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:3.2.4:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:3.2.5:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:4.0:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:4.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:4.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:4.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:horde:imp:4.0.4:*:*:*:*:*:*:*

← Back to Home