CVE-2007-6018 — Improper Input Validation in Framework

CWE-264CWE-20 — Improper Input Validation4 documents4 sources
Severity
5.8MEDIUMNVD
EPSS
1.4%
top 19.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Horde FrameworkHorde Groupware Webmail EditionHorde+1 more
Timeline
PublishedJan 11
Latest updateMay 1

Description

IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 8.6 | Impact: 4.9

Affected Packages4 packages

▶NVDhorde/framework3.1.5
▶NVDhorde/imp4.1.5
▶NVDhorde/horde3.1.5

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-cg63-j5p8-vpwf: IMP Webmail Client 4↗2022-05-01
▶

📋Vendor Advisories

1
Red Hat
horde: input validation vulnerabilities↗2008-01-10
▶

💬Community

1
Bugzilla
CVE-2007-6018 horde: input validation vulnerabilities↗2008-01-14
▶