CVE-2021-26929: 
Linux Debian vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in Horde Groupware Webmail Edition through version 5.2.22, specifically affecting the Horde_Text_Filter library before version 2.3.7. The vulnerability was identified and disclosed in February 2021 (NVD, Debian).

The vulnerability exists in the Text2html.php file's preProcess function, where an attacker can exploit the way JavaScript is handled when encoded as a link or email. The exploit specifically involves the use of \x00\x00\x00 and \x01\x01\x01 sequences that interfere with XSS defenses. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

An attacker can exploit this vulnerability by sending a specially crafted plain text email message containing malicious JavaScript code. If successful, the attacker could potentially take control of a user's mailbox and execute arbitrary JavaScript code in the context of the victim's browser session (Debian).

The vulnerability can be exploited remotely by sending a specially crafted email message. The attack requires user interaction (opening the malicious email) but does not require authentication. Proof-of-concept exploits have been published demonstrating the vulnerability (PacketStorm).

The vulnerability has been fixed in Horde_Text_Filter library version 2.3.7. For Debian 9 (Stretch) users, the fix is available in version 2.3.5-1+deb9u1 of the php-horde-text-filter package. Users are strongly recommended to upgrade to the patched versions (Debian).