CVE-2017-14920 eGroupware Community Edition Stored XSS vulnerability

What is CVE-2017-14920?

CVE-2017-14920 is a medium-severity cross-site scripting vulnerability in n/a, published on 29 Sep 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the application administrator.

Weakness: CWE-79

Which versions are affected by CVE-2017-14920?

2 open source packages ship an affected version, including egroupware/egroupware. It affects 1 product.

Products include Egroupware Egroupware.

How do I fix CVE-2017-14920?

Upgrade egroupware/egroupware to 16.1.20170922 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2017-14920 being exploited?

There is no known exploitation of CVE-2017-14920 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2008-2041 Code injection in n/a Critical 10.0
• CVE-2007-3154 Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and other packa Critical 10.0
• CVE-2007-3155 Other in n/a Critical 10.0
• CVE-2026-22243 EGroupware has SQL Injection in Nextmatch Filter Processing High 8.7
• CVE-2014-2988 Code injection in n/a High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qfg7-wc25-r3j2.