CVE-2008-0807: lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4…

PriorityP424medium4.9CVSS 2.0

AVNACMAuSCPIPAN

EPSS

1.38%

68.8th percentile

lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
horde	groupware	—	—
horde	groupware_webmail_edition	—	—
horde	turba_contact_manager	—	—

CVSS provenance

nvdv2.04.9MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N

vendor_redhat4.9MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.