PT-2015-7692 · Horde · Horde Groupware Webmail Edition+2

Published 2015-11-03 · Updated 2021-05-19 · CVE-2015-7984

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Horde versions prior to 5.2.8 Horde Groupware versions prior to 5.2.11 Horde Groupware Webmail Edition versions prior to 5.2.11

Description Multiple cross-site request forgery (CSRF) issues allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands, SQL queries, or PHP code. This is achieved via the cmd parameter to "admin/cmdshell.php", the sql parameter to "admin/sqlshell.php", or the php parameter to "admin/phpshell.php".

Recommendations For Horde versions prior to 5.2.8, update to version 5.2.8 or later. For Horde Groupware versions prior to 5.2.11, update to version 5.2.11 or later. For Horde Groupware Webmail Edition versions prior to 5.2.11, update to version 5.2.11 or later. As a temporary workaround, consider restricting access to the "admin/cmdshell.php", "admin/sqlshell.php", and "admin/phpshell.php" endpoints until a patch is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-7984

DLA-2350-1

DSA-3391-1

Affected Products

Horde

Horde Groupware

Horde Groupware Webmail Edition

References · 23

• 🔥 https://htbridge.com/advisory/HTB23272 · Exploit
• 🔥 https://exploit-db.com/exploits/38765 · Exploit
• https://osv.dev/vulnerability/CVE-2015-7984 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-7984 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7984 · Security Note
• https://security-tracker.debian.org/tracker/DLA-2350-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16908 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3391-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/php-horde · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7984 · Security Note
• https://security-tracker.debian.org/tracker/source-package/php-horde-kronolith · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3391-1 · Vendor Advisory
• http://lists.horde.org/archives/announce/2015/001124.html · Vendor Advisory
• http://lists.horde.org/archives/announce/2015/001137.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2350-1 · Vendor Advisory