CVE-2022-26874

MEDIO 5.4CVE-2022-26874 · Published 11/03/2022 · updated 17/06/2026

En resumen

CVE-2022-26874 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a horde mime viewer (horde).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.1%, mayor que el 64.3% de las vulnerabilidades.
Solución: actualizar a 2.2.4 o posterior.

Package	Affected versions	Patched versions
horde mime viewer horde	`< 2.2.4`	`2.2.4`

Description

lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.

References

blog.sonarsource.com/horde-webmail-account-takeover-via-email · Exploit
horde/Mime_Viewer commit 02b46ce · Patch
lists.debian.org/debian-lts-announce/2022/06/msg00007.html · Mailing List
lists.debian.org/debian-lts-announce/2022/08/msg00021.html · Mailing List
lists.debian.org/debian-lts-announce/2024/10/msg00015.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free