FKIE_CVE-2026-30238

Vulnerability from fkie_nvd - Published: 2026-03-06 22:16 - Updated: 2026-06-17 10:32
Severity
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in GroupOffice on the external/index flow. The f parameter (Base64 JSON) is decoded and then injected into an inline JavaScript block without strict escaping, allowing </script><script>...</script> injection and arbitrary JavaScript execution in the victim's browser. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.
References
security-advisories@github.comhttps://github.com/Intermesh/groupoffice/security/advisories/GHSA-7p2f-c33m-rv5vExploit, Vendor Advisory
Impacted products
Vendor Product Version
intermesh group-office *
intermesh group-office *
intermesh group-office *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "groupoffice",
          "vendor": "Intermesh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.8.155"
            },
            {
              "status": "affected",
              "version": "\u003c 25.0.88"
            },
            {
              "status": "affected",
              "version": "\u003c 26.0.10"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "415D8E7D-4453-4E5A-A217-075E542202CD",
              "versionEndExcluding": "6.8.155",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2B89827-16A4-41F5-8D9A-5F88E49B716F",
              "versionEndExcluding": "25.0.88",
              "versionStartIncluding": "25.0.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8AD3E6F-A69E-4CE5-9580-386D5EC22E51",
              "versionEndExcluding": "26.0.10",
              "versionStartIncluding": "25.2.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in GroupOffice on the external/index flow. The f parameter (Base64 JSON) is decoded and then injected into an inline JavaScript block without strict escaping, allowing \u003c/script\u003e\u003cscript\u003e...\u003c/script\u003e injection and arbitrary JavaScript execution in the victim\u0027s browser. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10."
    },
    {
      "lang": "es",
      "value": "Group-Office es una herramienta empresarial de gesti\u00f3n de relaciones con los clientes y groupware. Antes de las versiones 6.8.155, 25.0.88 y 26.0.10, existe una vulnerabilidad XSS reflejada en GroupOffice en el flujo externo/\u00edndice. El par\u00e1metro f (Base64 JSON) se decodifica y luego se inyecta en un bloque JavaScript en l\u00ednea sin un escape estricto, lo que permite la inyecci\u00f3n  y la ejecuci\u00f3n arbitraria de JavaScript en el navegador de la v\u00edctima. Este problema se ha corregido en las versiones 6.8.155, 25.0.88 y 26.0.10."
    }
  ],
  "id": "CVE-2026-30238",
  "lastModified": "2026-06-17T10:32:32.697",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-30238",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-09T20:44:43.774910Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-06T22:16:01.437",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-7p2f-c33m-rv5v"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.