CVE-2014-1691 The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted ser...
HighCVSS 7.5
EPSS 42.9%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/php-horde-util(Debian:12) | < 2.3.0-1 | 2.3.0-1 |
| horde application framework | <= 5.1.0 | No fix listed |
| horde application framework | = 5.0.0 | No fix listed |
| horde application framework | = 5.0.1 | No fix listed |
| horde application framework | = 5.0.2 | No fix listed |
| horde application framework | = 5.0.3 | No fix listed |
| horde application framework | = 5.0.4 | No fix listed |
References
- Debian Security Tracker CVE-2014-1691 vendor-advisory
- [oss-security] 20140128 Remote code execution in horde < 5.1.1 mailing-list patch
- [oss-security] 20140128 Re: Remote code execution in horde < 5.1.1 mailing-list patch
- [oss-security] 20140129 Re: Remote code execution in horde < 5.1.1 mailing-list
- DSA-2853 vendor-advisory
- github.com
- github.com exploit patch