{"id":"CVE-2020-8034","details":"Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.","modified":"2026-07-08T05:56:47.819438192Z","published":"2020-05-18T17:15:11.053Z","database_specific":{"unresolved_ranges":[{"source":"CPE_RANGE","vendor_product":"horde:gollem","cpes":["cpe:2.3:a:horde:gollem:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"3.0.13"}]}]},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00033.html"},{"type":"ADVISORY","url":"https://github.com/horde/gollem/blob/95b2a4212d734f1b27aaa7a221d2fa1370d2631f/docs/CHANGES"},{"type":"ADVISORY","url":"https://lists.horde.org/archives/announce/2020/001289.html"},{"type":"ADVISORY","url":"https://lists.horde.org/archives/gollem/Week-of-Mon-20200420/001990.html"},{"type":"FIX","url":"https://github.com/horde/gollem/commits/master"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/horde/groupware","events":[{"introduced":"cf488bd4e87e1ff0d9e11a5a3c2d2f805172dd70"},{"last_affected":"cf488bd4e87e1ff0d9e11a5a3c2d2f805172dd70"}],"database_specific":{"cpe":"cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*","extracted_events":[{"introduced":"5.2.22"},{"last_affected":"5.2.22"}],"source":"CPE_STRING"}}],"versions":["5.2.22","v5.2.22"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8034.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/horde/horde","events":[{"introduced":"da4d701808c3af4100bd1f2d7f0fd07854267fa9"},{"last_affected":"da4d701808c3af4100bd1f2d7f0fd07854267fa9"}],"database_specific":{"source":"CPE_STRING","cpe":"cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*","extracted_events":[{"introduced":"5.2.22"},{"last_affected":"5.2.22"}]}}],"versions":["5.2.22","webmail-5.2.22"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8034.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}