CVE-2008-1284

Horde Groupware < 1.0.4 and Groupware Webmail Edition < 1.0.5 - Authenticated Path Traversal via Theme Name

Title source: llm
STIX 2.1

Description

Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name.

References (17)

Core 17
Core References
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3726
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29286
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/41054
Various Sources mailing-list x_refsource_mlist
http://lists.horde.org/archives/announce/2008/000383.html
Various Sources mailing-list x_refsource_mlist
http://lists.horde.org/archives/announce/2008/000384.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/489239/100/0/threaded
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200805-01.xml
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1519
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30047
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29374
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/489289/100/0/threaded
Patch mailing-list x_refsource_mlist
http://lists.horde.org/archives/announce/2008/000382.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0822/references
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/28153
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29400

Scores

EPSS 0.0168
EPSS Percentile 74.1%

Details

CWE
CWE-22
Status published
Products (3)
horde/groupware < 1.0.4
horde/groupware_webmail_edition < 1.0.5
horde/horde 3.1.6
Published Mar 11, 2008
Tracked Since Feb 18, 2026