Lucene search

ZdiCVE-2020-8866

HistoryMar 23, 2020 - 9:15 p.m.

CVE-2020-8866

2020-03-2321:15:12

CWE-434

zdi

web.nvd.nist.gov

cve-2020-8866

vulnerability

remote attackers

arbitrary files

horde groupware webmail edition

authentication

exploit

add.php

validation

user-supplied data

upload

execute code

www-data

zdi-can-10125

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.006

Percentile

77.8%

JSON

This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within add.php. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10125.

Affected configurations

Nvd

Vulners

Node

hordegroupwareMatch5.2.22webmail

hordehorde_formRange<2.0.20

Node

debiandebian_linuxMatch8.0

VendorProductVersionCPE
hordegroupware5.2.22cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*
hordehorde_form*cpe:2.3:a:horde:horde_form:*:*:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
horde	groupware	5.2.22	cpe:2.3:a:horde:groupware:5.2.22::::webmail:::
horde	horde_form	*	cpe:2.3:a:horde:horde_form::::::::
debian	debian_linux	8.0	cpe:2.3:o:debian:debian_linux:8.0:::::::*

CNA Affected

[
  {
    "product": "Groupware Webmail Edition",
    "vendor": "Horde",
    "versions": [
      {
        "status": "affected",
        "version": "5.2.22"
      }
    ]
  }
]