CVE-2001-1258 Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the s...
LowCVSS 3.6
EPSS 0.46%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| horde imp | = 2.0 | No fix listed |
| horde imp | = 2.2 | No fix listed |
| horde imp | = 2.2.1 | No fix listed |
| horde imp | = 2.2.2 | No fix listed |
| horde imp | = 2.2.3 | No fix listed |
| horde imp | = 2.2.4 | No fix listed |
| horde imp | = 2.2.5 | No fix listed |
References
- CLA-2001:410 vendor-advisory
- 20010721 IMP 2.2.6 (SECURITY) released mailing-list
- CSSA-2001-027.0 vendor-advisory
- DSA-073 exploit patch vendor-advisory
- imp-prefslang-gain-privileges(6906) vdb-entry
- 3083 vdb-entry