eGroupWare Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in eGroupWare version 17.1.20190111. The issue resides in the calendar/freebusy.php file, where the application fails to properly sanitize the 'user' HTTP GET parameter. This flaw allows unauthenticated remote attackers to inject arbitrary web scripts or HTML, which is then reflected back to the user without any sanitization.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.