PT-2020-20337 · Horde · Horde Groupware Webmail Edition

Andrea Cardaci · Published 2020-03-10 · Updated 2022-10-07 · CVE-2020-8866

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Horde Groupware Webmail Edition version 5.2.22

Description This issue allows remote attackers to create arbitrary files on affected installations. Authentication is required to exploit this. The flaw exists within the add.php file and results from the lack of proper validation of user-supplied data, allowing the upload of arbitrary files. An attacker can leverage this, in conjunction with other issues, to execute code in the context of the www-data user.

Recommendations For Horde Groupware Webmail Edition version 5.2.22, consider disabling the add.php file as a temporary workaround until a patch is available. Restrict access to this file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-8866

DLA-2162-1

ZDI-20-275

Affected Products

Horde Groupware Webmail Edition

References · 15

• 🔥 https://exploit-db.com/exploits/48210 · Exploit
• 🔥 https://exploit-db.com/exploits/48209 · Exploit
• https://ubuntu.com/security/CVE-2020-8866 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8866 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-8866 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-8866 · Security Note
• https://lists.horde.org/archives/announce/2020/001288.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8866 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8866 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2162-1 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-275 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-8866 · Vendor Advisory
• https://github.com/horde/Form/commit/813f8e7e9479fad4546b89c569325ee9eef60b0f · Note
• https://t.me/cvenotify/2052 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2020/03/msg00036.html · Note