Description
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input. This could result in a reflected cross-site scripting (XSS) attack. This issue has been patched in versions 6.8.123 and 25.0.27.
References (3)
Core 3
Core References
Third Party Advisory x_refsource_confirm
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-xv2x-v374-92gv
Patch x_refsource_misc
https://github.com/Intermesh/groupoffice/commit/1e2a2450f204174f87a93217838d74718996dcdd
Scores
CVSS v3
6.1
EPSS
0.0013
EPSS Percentile
31.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (1)
intermesh/group-office
< 6.8.123
Published
Jun 17, 2025
Tracked Since
Feb 18, 2026