CVE-2007-6018: IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers… | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published Jan 11, 2008

CVE-2007-6018

IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers…

–

CVSS

1.8%

EPSS

No

On KEV

Description

IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message.

Exploitation

Is it being used?

Exploit prediction (EPSS)1.8% · higher than 78% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

FR

Framework · Horde

3.1.5 · source: NVD

GW

Groupware Webmail Edition · Horde

1.0.3 · source: NVD

HO

3.1.5 · source: NVD

IM

4.1.5 · source: NVD

Affected product

FR

Framework

Horde

All Framework CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2007-6018

https://www.cve.org/CVERecord?id=CVE-2007-6018

http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17&r2=1.17.2.1&ty=h

http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12&r2=1.12.2.1&ty=h

lists.horde.org

http://lists.horde.org/archives/announce/2008/000360.html

lists.horde.org

http://lists.horde.org/archives/announce/2008/000365.html

lists.horde.org

http://lists.horde.org/archives/announce/2008/000366.html

lists.opensuse.org

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html