CVE-2012-6620: Multiple cross-site scripting (XSS) vulnerabilities in the (1) tasks and (2) search views in Horde Kronolit...

Security readout for executives and security teams

CVE-2012-6620 is a cross-site scripting issue in Horde Kronolith H4 before 3.0.17. An attacker could inject script or HTML through the tasks or search views. The bundle does not provide CVSS, detailed vectors, or evidence of active exploitation. Likely exposure is limited to organizations still running Horde Kronolith H4 versions earlier than 3.0.17, especially where Horde is reachable by users or the internet. The source bundle does not enumerate affected CPEs or deployment conditions. Treat this as a legacy application hygiene issue unless Kronolith is exposed or business-critical. Prioritize confirmation and patching for internet-facing or broadly accessible Horde deployments. Mitigation focus: Inventory Horde Kronolith deployments and identify the Kronolith H4 version.; Upgrade Kronolith H4 to 3.0.17 or later where vendor guidance applies.; Restrict access to Horde interfaces that do not need public exposure..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.