PT-2008-2876 · Horde · Horde Groupware+2

Publicado

2008-03-11

·

Atualizado

2018-10-11

·

CVE-2008-1284

CVSS v2.0

6.0

Média

VetorAV:N/AC:M/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Horde version 3.1.6 Horde Groupware versions prior to 1.0.5 Horde Groupware Webmail Edition versions prior to 1.0.6
Description The issue allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name. This can occur when running with certain configurations.
Recommendations For Horde version 3.1.6, update to a version later than 3.1.6 to resolve the issue. For Horde Groupware versions prior to 1.0.5, update to version 1.0.5 or later. For Horde Groupware Webmail Edition versions prior to 1.0.6, update to version 1.0.6 or later.

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-1284
DSA-1519-1

Produtos afetados

Horde
Horde Groupware
Horde Groupware Webmail Edition