{"id":"CVE-2020-8034","details":"Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.","modified":"2026-10-15T10:49:33.936157952Z","published":"2020-05-18T17:15:11.053Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"source":"CPE_RANGE","range":[{"fixed":"3.0.13"}]}],"vendor_product":"horde:gollem","cpes":["cpe:2.3:a:horde:gollem:*:*:*:*:*:*:*:*"]},{"vendor_product":"horde:groupware","cpes":["cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*"],"extracted_events":[{"source":"CPE_STRING","range":[{"introduced":"5.2.22"},{"last_affected":"5.2.22"}]}]}]},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00033.html"},{"type":"ADVISORY","url":"https://github.com/horde/gollem/blob/95b2a4212d734f1b27aaa7a221d2fa1370d2631f/docs/CHANGES"},{"type":"ADVISORY","url":"https://lists.horde.org/archives/announce/2020/001289.html"},{"type":"ADVISORY","url":"https://lists.horde.org/archives/gollem/Week-of-Mon-20200420/001990.html"},{"type":"FIX","url":"https://github.com/horde/gollem/commits/master"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/horde/groupware","events":[{"introduced":"cf488bd4e87e1ff0d9e11a5a3c2d2f805172dd70"},{"last_affected":"cf488bd4e87e1ff0d9e11a5a3c2d2f805172dd70"}],"database_specific":{"extracted_events":[{"source":"CPE_STRING","cpe":"cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*","range":[{"introduced":"5.2.22"},{"last_affected":"5.2.22"}]}]}}],"versions":["5.2.22","v5.2.22"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-8034.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/horde/horde","events":[{"introduced":"da4d701808c3af4100bd1f2d7f0fd07854267fa9"},{"last_affected":"da4d701808c3af4100bd1f2d7f0fd07854267fa9"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*","range":[{"introduced":"5.2.22"},{"last_affected":"5.2.22"}],"source":"CPE_STRING"}]}}],"versions":["5.2.22","webmail-5.2.22"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-8034.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}