CVE-2007-6018

2008-01-1102:46:00

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

6.6

Confidence

Low

EPSS

0.009

Percentile

82.6%

JSON

IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) “purge” deleted emails via a crafted email message.

Affected configurations

Nvd

Node

hordeframeworkMatch3.1.5

hordegroupware_webmail_editionMatch1.0.3

hordehordeMatch3.1.5

hordeimpMatch4.1.5

VendorProductVersionCPE
hordeframework3.1.5cpe:2.3:a:horde:framework:3.1.5:*:*:*:*:*:*:*
hordegroupware_webmail_edition1.0.3cpe:2.3:a:horde:groupware_webmail_edition:1.0.3:*:*:*:*:*:*:*
hordehorde3.1.5cpe:2.3:a:horde:horde:3.1.5:*:*:*:*:*:*:*
hordeimp4.1.5cpe:2.3:a:horde:imp:4.1.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
horde	framework	3.1.5	cpe:2.3:a:horde:framework:3.1.5:::::::*
horde	groupware_webmail_edition	1.0.3	cpe:2.3:a:horde:groupware_webmail_edition:1.0.3:::::::*
horde	horde	3.1.5	cpe:2.3:a:horde:horde:3.1.5:::::::*
horde	imp	4.1.5	cpe:2.3:a:horde:imp:4.1.5:::::::*