CVE-2007-6018 IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrar...
MediumCVSS 5.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| horde framework | = 3.1.5 | No fix listed |
| horde groupware webmail edition | = 1.0.3 | No fix listed |
| horde | = 3.1.5 | No fix listed |
| horde imp | = 4.1.5 | No fix listed |
References
- cvs.horde.org
- cvs.horde.org
- [announce] 20080109 Horde 3.1.6 (final) mailing-list
- [announce] 20080109 Horde Groupware 1.0.3 (final) mailing-list
- [announce] 20080110 Horde Groupware Webmail Edition 1.0.4 (final) mailing-list
- SUSE-SR:2009:007 vendor-advisory
- 28020 third-party-advisory vendor-advisory
- 28546 third-party-advisory
- 29184 third-party-advisory
- 29185 third-party-advisory
- 29186 third-party-advisory
- 34418 third-party-advisory
- secunia.com vendor-advisory
- DSA-1470 vendor-advisory
- 27223 patch vdb-entry
- bugzilla.redhat.com
- horde-impgroupware-filter-security-bypass(39595) vdb-entry
- FEDORA-2008-2040 vendor-advisory
- FEDORA-2008-2087 vendor-advisory