Published: 19/11/2015 Updated: 19/05/2021

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 685

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Multiple cross-site request forgery (CSRF) vulnerabilities in Horde prior to 5.2.8, Horde Groupware prior to 5.2.11, and Horde Groupware Webmail Edition prior to 5.2.11 allow remote malicious users to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php, (2) SQL queries via the sql parameter to admin/sqlshell.php, or (3) PHP code via the php parameter to admin/phpshell.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
horde groupware
horde horde application framework
debian debian linux 8.0

Debian Bug report logs - #909738 php-horde-kronolith: CVE-2017-16908 XSS via Name field Package: php-horde-kronolith; Maintainer for php-horde-kronolith is Horde Maintainers <team+debian-horde-team@trackerdebianorg>; Source for php-horde-kronolith is src:php-horde-kronolith (PTS, buildd, popcon) Reported by: Markus Koschan ...

It was discovered that the web-based administration interface in the Horde Application Framework did not guard against Cross-Site Request Forgery (CSRF) attacks As a result, other, malicious web pages could cause Horde applications to perform actions as the Horde user The oldstable distribution (wheezy) did not contain php-horde packages For the ...

Advisory ID: HTB23272 Product: Horde Groupware Vendor: wwwhordeorg Vulnerable Version(s): 5210 and probably prior Tested Version: 5210 Advisory Publication: September 30, 2015 [without technical details] Vendor Notification: September 30, 2015 Vendor Patch: October 22, 2015 Public Disclosure: November 18, 2015 Vulnerability Typ ...

Horde Groupware version 5210 suffers from a cross site request forgery vulnerability ...

CWE-352 http://lists.horde.org/archives/announce/2015/001124.html http://lists.horde.org/archives/announce/2015/001137.html https://www.htbridge.com/advisory/HTB23272 http://lists.horde.org/archives/announce/2015/001138.html http://www.debian.org/security/2015/dsa-3391 https://www.exploit-db.com/exploits/38765/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=909738 https://nvd.nist.gov https://www.exploit-db.com/exploits/38765/https://www.debian.org/security/./dsa-3391

CVE-2015-7984

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect