Unscored severity · published Feb 19, 2008
CVE-2008-0807
lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware…
–
CVSS
1.4%
EPSS
No
On KEV
Description
lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Groupware · Horde
1.0.3 · source: NVD
GW
Groupware Webmail Edition · Horde
1.0.4 · source: NVD
TC
Turba Contact Manager · Horde
2.1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0807
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058
Patch
http://lists.horde.org/archives/announce/2008/000378.html
Patch
http://lists.horde.org/archives/announce/2008/000379.html
Patch
http://lists.horde.org/archives/announce/2008/000380.html
Patch
http://lists.horde.org/archives/announce/2008/000381.html
Vendor Advisory
http://secunia.com/advisories/28982
More from Groupware
9.8
CVE-2020-8518
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution
8.8
CVE-2013-6364
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
8.8
CVE-2019-12095
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a…
8.8
CVE-2019-9858
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17
8.8
CVE-2017-7413
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has…