Description
The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename.
Exploits (1)
Scores
CVSS v3
7.5
EPSS
0.1269
EPSS Percentile
94.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-425
Status
published
Products (1)
horde/groupware
5.2.21
Published
Oct 11, 2017
Tracked Since
Feb 18, 2026