Description

Horde Groupware Webmail Edition is a free, enterprise ready, browser-based communication suite. Pedro Ribeiro reported a remote code execution bug that is affecting Horde versions from at least horde 3.1.x to 5.1.1.

Remediation

Upgrade to the latest version of Horde.

References

Remote code execution in horde

Fix commit

Changelog

Related Vulnerabilities

MediaWiki Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2021-42040)

WordPress Plugin Quiz and Survey Master (QSM)-Easy Quiz and Survey Maker Cross-Site Scripting (7.1.18)

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-4319)

JBoss Application Server Privilege Escalation Vulnerability (CVE-2007-1354)

WordPress Plugin WP-Stats Multiple Vulnerabilities (2.51)

Severity

High

Classification

CVE-2014-1691 CWE-94 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Code Execution Missing Update