CVE catalog

CVE-2020-8034

php-horde-gollem: CVE-2020-8034

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.97% · Oct 25, 2026

Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-horde-gollemsid3.0.13-5fixed
Debianphp-horde-gollembookworm3.0.13-5fixed
Ubuntuphp-horde-gollem16.043.0.5-1vulnerable
Ubuntuphp-horde-gollem16.043.0.6-1vulnerable
Ubuntuphp-horde-gollem16.043.0.7-1vulnerable
Ubuntuphp-horde-gollem16.043.0.7-1build1vulnerable
Ubuntuphp-horde-gollem18.043.0.11-1vulnerable
Ubuntuphp-horde-gollem18.043.0.12-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-horde-gollemsourcesid3.0.12-6not yet assignedNot reported[961649]
Debianphp-horde-gollemsourcebookworm3.0.12-6not yet assignedNot reported[961649]

[Debian bug #961649]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-horde-gollem]Fixed
    Details (2)

    • 3.0.13-5 · all · bookworm

      Fixed · Fixed: 3.0.12-6

      dsa · php-horde-gollem · debian · bookworm; dsa · php-horde-gollem · debian · 12

    • 3.0.13-5 · all · bookworm

      Fixed · Fixed: 3.0.12-6

      dsa · php-horde-gollem · debian · bookworm; dsa · php-horde-gollem · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]