Unscored severity · published Mar 16, 2007
CVE-2007-1474
Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files…
–
CVSS
5.1%
EPSS
No
On KEV
Description
Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Horde Application Framework · Horde
3.0.0; 3.0.4; 3.1.3 · source: NVD
IM
Imp · Horde
2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1474
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1474
Vendor Advisory
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489
Patch
http://lists.horde.org/archives/announce/2007/000315.html
secunia.com
http://secunia.com/advisories/27565
www.debian.org
http://www.debian.org/security/2007/dsa-1406
www.securityfocus.com
http://www.securityfocus.com/bid/22985
www.securitytracker.com
http://www.securitytracker.com/id?1017784
More from Horde Application Framework
–
CVE-2015-7984
Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote…
–
CVE-2014-1691
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP…
–
CVE-2010-3077
Cross-site scripting (XSS) vulnerability in util/icon_browser.php in the Horde Application Framework before 3.3.9 allows remote attackers to inject arbitrary web script or HTML…
–
CVE-2010-3694
Cross-site request forgery (CSRF) vulnerability in the Horde Application Framework before 3.3.9 allows remote attackers to hijack the authentication of unspecified victims for…
–
CVE-2009-3237
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and…