PT-2008-1531 · Horde · Imp Webmail Client+2

Tomas Hoger · Published 2008-01-11 · Updated 2017-07-29 · CVE-2007-6018

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IMP Webmail Client version 4.1.5 Horde Application Framework version 3.1.5 Horde Groupware Webmail Edition version 1.0.3

Description The issue allows remote attackers to delete arbitrary e-mail messages via a modified numeric ID or "purge" deleted emails via a crafted email message, due to the lack of validation of unspecified HTTP requests.

Recommendations For IMP Webmail Client version 4.1.5, update to a version that includes input validation for HTTP requests. For Horde Application Framework version 3.1.5, implement proper validation of HTTP requests to prevent unauthorized actions. For Horde Groupware Webmail Edition version 1.0.3, restrict access to email management functions until a fix is applied that validates HTTP requests.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-6018

DSA-1470-1

Affected Products

Horde Application Framework

Horde Groupware Webmail Edition

Imp Webmail Client

References · 21

• http://debian.org/security/2008/dsa-1470 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html · Vendor Advisory
• http://securityfocus.com/bid/27223 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-6018 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00927.html · Vendor Advisory
• http://secunia.com/advisories/28020 · Vendor Advisory
• http://secunia.com/secunia_research/2007-102/advisory · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00888.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6018 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39595 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=428625 · Note
• http://secunia.com/advisories/29186 · Note
• http://secunia.com/advisories/34418 · Note
• http://lists.horde.org/archives/announce/2008/000360.html · Note
• http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12&r2=1.12.2.1&ty=h · Note