CVE-2020-8035: 
Linux Debian vulnerability analysis and mitigation

The image view functionality in Horde Groupware Webmail Edition before version 5.2.22 was affected by a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered in May 2020 and assigned identifier CVE-2020-8035 (NVD).

The vulnerability allowed attackers to upload SVG images containing malicious JavaScript payloads that would be executed when viewed. This stored XSS vulnerability existed in the image view functionality of the application (Debian LTS).

If successfully exploited, an attacker could gain unauthorized access to a victim's webmail account by making them visit a malicious URL that triggered the stored XSS payload (NVD, Debian LTS).

The vulnerability required the attacker to upload a specially crafted SVG image file containing JavaScript code. When the victim viewed this image through the application's image view functionality, the malicious JavaScript would execute in their browser context (NVD).

The vulnerability was fixed in Horde Groupware Webmail Edition version 5.2.22. Users should upgrade to this version or later to protect against this vulnerability. For Debian 8 'Jessie' users, the fix was included in version 5.2.1+debian0-2+deb8u6 (Debian LTS).