{"id":"CVE-2017-16907","details":"In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action.","modified":"2026-07-08T05:49:58.397545045Z","published":"2017-11-20T20:29:00.387Z","database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"horde:groupware","cpes":["cpe:2.3:a:horde:groupware:5.2.19:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.2.19"},{"last_affected":"5.2.19"}]}]},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00046.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00047.html"},{"type":"REPORT","url":"http://code610.blogspot.com/2017/11/rce-via-xss-horde-5219.html"},{"type":"FIX","url":"https://github.com/horde/base/commit/fb2113bbcd04bd4a28c46aad0889fb0a3979a230"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/horde/base","events":[{"introduced":"0"},{"fixed":"fb2113bbcd04bd4a28c46aad0889fb0a3979a230"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v5.2.19","v5.2.18","v5.2.17","v5.2.16","v5.2.15","v5.2.14","v5.2.13","v5.2.12","v5.2.11","v5.2.10","v5.2.9","v5.2.8","v5.2.7","v5.2.6","v5.2.5","v5.2.4","v5.2.3","v5.2.2","v5.2.1","v5.2.0","v5.2.0rc2","v5.2.0rc1","v5.2.0beta2","v5.2.0beta1","v5.2.0alpha1","v5.1.5","v5.1.4","v5.1.3","v5.1.2","v5.1.1","v5.1.0","v5.1.0rc1","v5.1.0beta3","v5.1.0beta2","v5.1.0beta1","v5.0.4","v5.0.3","v5.0.2","v5.0.1","v5.0.0","v5.0.0rc1","v5.0.0beta6","v5.0.0beta5","v5.0.0beta4","v5.0.0beta3","v5.0.0beta2","v5.0.0beta1","v5.0.0alpha1","v4.0.1","v4.0.0","v4.0.0rc2","v4.0.0rc1","v4.0.0beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16907.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/horde/groupware","events":[{"introduced":"861c2461b4c16a64383cfe4daa89eba79dff541a"},{"last_affected":"87b6ef2c1f8af1d80ad4e7ac182bd7b3341d45ae"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:horde:groupware:5.2.19:*:*:*:*:*:*:*","cpe:2.3:a:horde:groupware:5.2.21:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.2.19"},{"last_affected":"5.2.19"},{"introduced":"5.2.21"},{"last_affected":"5.2.21"}]}}],"versions":["5.2.19","5.2.21","v5.2.21","v5.2.20","v5.2.19"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16907.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/horde/horde","events":[{"introduced":"801083b02b92b8ba6710471253ecf4b36943c80d"},{"last_affected":"943774c44518b50ad321bec160d4f8a3c04cbadb"}],"database_specific":{"extracted_events":[{"introduced":"5.2.19"},{"last_affected":"5.2.19"},{"introduced":"5.2.21"},{"last_affected":"5.2.21"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:horde:groupware:5.2.19:*:*:*:*:*:*:*","cpe:2.3:a:horde:groupware:5.2.21:*:*:*:*:*:*:*"]}}],"versions":["5.2.19","5.2.21","webmail-5.2.21","groupware-5.2.21","whups-3.0.11","ansel-3.0.7","turba-4.2.20","trean-1.1.8","nag-4.2.15","kronolith-4.2.22","gollem-3.0.11","imp-6.2.20","horde-5.2.16","whups-3.0.10","webmail-5.2.20","groupware-5.2.20","kronolith-4.2.21","ingo-3.2.15","imp-6.2.19","horde-5.2.15","webmail-5.2.19"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16907.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}