CVE-2012-6640

Published: Apr 5, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.

Affected (37)

Products: Horde: Groupware, Imp

Horde

2 products

Groupware

Imp

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Horde Groupware	Up to 4.0.8
Horde Groupware	Version 4.0.1
Horde Groupware	Version 4.0.2
Horde Groupware	Version 4.0.3
Horde Groupware	Version 4.0.4
Horde Groupware	Version 4.0.5
Horde Groupware	Version 4.0.6
Horde Groupware	Version 4.0.7
Horde Groupware	Version 4.0
Horde Groupware	Version 4.0 rc1
Horde Groupware	Version 4.0 rc2

Configuration B

26 vulnerable

Vulnerable Software	Affected Versions
Horde Imp	Up to 5.0.21
Horde Imp	Version 5.0.10
Horde Imp	Version 5.0.11
Horde Imp	Version 5.0.12
Horde Imp	Version 5.0.13
Horde Imp	Version 5.0.14
Horde Imp	Version 5.0.15
Horde Imp	Version 5.0.16
Horde Imp	Version 5.0.17
Horde Imp	Version 5.0.18
Horde Imp	Version 5.0.19
Horde Imp	Version 5.0.1
Horde Imp	Version 5.0.20
Horde Imp	Version 5.0.2
Horde Imp	Version 5.0.3
Horde Imp	Version 5.0.4
Horde Imp	Version 5.0.5
Horde Imp	Version 5.0.6
Horde Imp	Version 5.0.7
Horde Imp	Version 5.0.8
Horde Imp	Version 5.0.9
Horde Imp	Version 5.0
Horde Imp	Version 5.0 alpha1
Horde Imp	Version 5.0 beta1
Horde Imp	Version 5.0 rc1
Horde Imp	Version 5.0 rc2