PT-2020-20336 · Horde · Horde Groupware Webmail Edition

Andrea Cardaci · Published 2020-03-10 · Updated 2022-10-07 · CVE-2020-8865

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Horde Groupware Webmail Edition version 5.2.22

Description This issue allows remote attackers to execute local PHP files on affected installations. Authentication is required to exploit this issue. The specific flaw exists within the edit.php file. When parsing the params[template] parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other issues to execute code in the context of the www-data user.

Recommendations For Horde Groupware Webmail Edition version 5.2.22, as a temporary workaround, consider disabling the edit.php file or restricting access to it until a patch is available. Additionally, restrict the use of the params[template] parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

RCE

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2020-8865

DLA-2175-1

ZDI-20-276

Affected Products

Horde Groupware Webmail Edition

References · 17

• 🔥 https://exploit-db.com/exploits/48210 · Exploit
• 🔥 https://exploit-db.com/exploits/48209 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8865 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-276 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-8865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8865 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-8865 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-8865 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8865 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2175-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8865 · Vendor Advisory
• https://github.com/horde/trean/commit/db0714a0c04d87bda9e2852f1b0d259fc281ca75 · Note
• https://github.com/horde/trean/commit/055029f551501803d7e293a48316e2cf31307908 · Note
• https://lists.horde.org/archives/announce/2020/001286.html · Note
• https://lists.debian.org/debian-lts-announce/2020/04/msg00009.html · Note