CVE-2009-0932

NUCLEI

Debian Horde - Path Traversal

Title source: rule

Description

Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name.

Exploits (1)

exploitdb WORKING POC VERIFIED

by skysbsb · textwebappsphp

https://www.exploit-db.com/exploits/16154

View Code ZIP pw:eip

Nuclei Templates (1)

Horde/Horde Groupware - Local File Inclusion

MEDIUMby pikpikcu

References (12)

[Vendor Advisory] http://cvs.horde.org/co.php/groupware/docs/groupware/CHANGES?r=1.28.2.5

[Vendor Advisory] http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.413.2.5

[Vendor Advisory] http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.503

[Vendor Advisory] http://lists.horde.org/archives/announce/2009/000482.html

[Vendor Advisory] http://lists.horde.org/archives/announce/2009/000483.html

[Vendor Advisory] http://lists.horde.org/archives/announce/2009/000486.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html

[Vendor Advisory] http://secunia.com/advisories/33695

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/33491

[Third Party Advisory] http://secunia.com/advisories/34418

[Third Party Advisory] http://secunia.com/advisories/34609

[Third Party Advisory] http://securityreason.com/securityalert/8077

Scores

EPSS 0.0561

EPSS Percentile 90.4%

Details

CWE

CWE-22

Status published

Products (10)

debian/horde 3.2

debian/horde 3.2.2

debian/horde 3.2.3

debian/horde 3.3

debian/horde 3.3.1

debian/horde 3.3.2

debian/horde_groupware 1.1.1

debian/horde_groupware 1.1.2

debian/horde_groupware 1.1.3

debian/horde_groupware 1.1.4

Published Mar 17, 2009

Tracked Since Feb 18, 2026