CVE-2023-38329

An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthenticated remote attackers to inject arbitrary web script or HTML into the "user" HTTP/GET parameter, which reflects its input without sanitization.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.gruppotim.it/it/footer/red-team.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:egroupware:egroupware:17.1.20190111:*:*:*:community:*:*:*

History

11 Sep 2025, 20:49

Type	Values Removed	Values Added
First Time		Egroupware egroupware Egroupware
CPE		cpe:2.3:a:egroupware:egroupware:17.1.20190111::::community:::
References	~~() https://www.gruppotim.it/it/footer/red-team.html -~~	() https://www.gruppotim.it/it/footer/red-team.html - Third Party Advisory

15 Jul 2025, 20:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.1
CWE		CWE-79

15 Jul 2025, 13:14

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en eGroupWare 17.1.20190111. Existe una vulnerabilidad de cross-site scripting (XSS) reflejado en calendar/freebusy.php, que permite a atacantes remotos no autenticados inyectar código web o HTML arbitrario en el parámetro HTTP/GET "usuario", que refleja su entrada sin depurar.

11 Jul 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-11 15:15

Updated : 2025-09-11 20:49

NVD link : CVE-2023-38329

Mitre link : CVE-2023-38329

CVE.ORG link : CVE-2023-38329

JSON object : View

Products Affected

egroupware

egroupware

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.1 /10