CVE-2017-14920: Cross-site Scripting

September 30, 2017 (updated October 5, 2017)

A Stored XSS vulnerability in eGroupware Community Edition allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the application administrator.

References

openwall.com/lists/oss-security/2017/09/28/12
nvd.nist.gov/vuln/detail/CVE-2017-14920

Code Behaviors & Features

Detect and mitigate CVE-2017-14920 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →