CVE-2007-1474 Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privi...
MediumCVSS 6.8
EPSS 5.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| horde application framework | = 3.0.0 | No fix listed |
| horde application framework | = 3.0.4 | No fix listed |
| horde application framework | = 3.1.3 | No fix listed |
| horde imp | = 2.0 | No fix listed |
| horde imp | = 2.2 | No fix listed |
| horde imp | = 2.2.1 | No fix listed |
| horde imp | = 2.2.2 | No fix listed |
| horde imp | = 2.2.3 | No fix listed |
| horde imp | = 2.2.4 | No fix listed |
| horde imp | = 2.2.5 | No fix listed |
| horde imp | = 2.2.6 | No fix listed |
| horde imp | = 2.2.7 | No fix listed |
| horde imp | = 2.2.8 | No fix listed |
| horde imp | = 2.3 | No fix listed |
| horde imp | = 3.0 | No fix listed |
| horde imp | = 3.1 | No fix listed |
| horde imp | = 3.1.2 | No fix listed |
| horde imp | = 3.2 | No fix listed |
| horde imp | = 3.2.1 | No fix listed |
| horde imp | = 3.2.2 | No fix listed |
| horde imp | = 3.2.3 | No fix listed |
| horde imp | = 3.2.4 | No fix listed |
| horde imp | = 3.2.5 | No fix listed |
| horde imp | = 3.2.6 | No fix listed |
References
- 20070315 Horde Project Cleanup Script Arbitrary File Deletion Vulnerability third-party-advisory vendor-advisory
- [announce] 20070314 Horde 3.1.4 (final) mailing-list patch vendor-advisory
- 27565 third-party-advisory
- DSA-1406 vendor-advisory
- 22985 vdb-entry
- 1017784 vdb-entry
- 1017785 vdb-entry
- ADV-2007-0965 vdb-entry
- horde-cron-file-deletion(32997) vdb-entry