Unscored severity · published Sep 25, 2012
CVE-2012-0209
Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced…
–
CVSS
71.9%
EPSS
No
On KEV
Description
Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers to execute arbitrary PHP code.
Exploitation
Is it being used?
Exploit prediction (EPSS)71.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Groupware · Horde
1.2.10; 1.2.10 · source: NVD
HO
Horde · Horde
3.3.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0209
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0209
Exploit
http://dev.horde.org/h/jonah/stories/view.php?channel_id=1&id=155
Exploit
http://eromang.zataz.com/2012/02/15/cve-2012-0209-horde-backdoor-analysis/
Exploit
http://lists.horde.org/archives/announce/2012/000751.html
Exploit
http://packetstormsecurity.org/files/109874/Horde-3.3.12-Backdoor-Arbitrary-PHP-Code-Execution.html
Patch
https://bugzilla.redhat.com/show_bug.cgi?id=790877
More from Groupware
9.8
CVE-2020-8518
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution
8.8
CVE-2013-6364
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
8.8
CVE-2019-12095
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a…
8.8
CVE-2019-9858
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17
8.8
CVE-2017-7413
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has…