Description

Horde Groupware Webmail Edition is a free, enterprise ready, browser-based communication suite. Pedro Ribeiro reported a remote code execution bug that is affecting Horde versions from at least horde 3.1.x to 5.1.1.

Remediation

Upgrade to the latest version of Horde.

References

Remote code execution in horde

Fix commit

Changelog

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-45373)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-5406)

WordPress Plugin VDZ CallBack Cross-Site Scripting (1.14.5)

phpMyAdmin Improper Input Validation Vulnerability (CVE-2016-9863)

WordPress Plugin Mapplic-Custom Interactive Map Server-Side Request Forgery (6.1)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Code Execution Missing Update CWE-94 CVE-2014-1691