Login Request a demo
Unscored severity · published Apr 1, 2014
CVE-2014-1691
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP…
–
CVSS
42.9%
EPSS
No
On KEV
Description
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
Exploitation
Is it being used?
Exploit prediction (EPSS)42.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Horde Application Framework · Horde
through 5.1.0; 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4 · source: NVD
Affected product
HA
Horde Application Framework
Horde
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-1691
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-1691
Patch
http://seclists.org/oss-sec/2014/q1/153
Patch
http://seclists.org/oss-sec/2014/q1/156
seclists.org
http://seclists.org/oss-sec/2014/q1/169
www.debian.org
http://www.debian.org/security/2014/dsa-2853
github.com
https://github.com/horde/horde/blob/82c400788537cfc0106b68447789ff53793ac086/bundles/groupware/docs/CHANGES#L215
Exploit
https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3
More from Horde Application Framework
–
CVE-2015-7984
Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote…
–
CVE-2010-3077
Cross-site scripting (XSS) vulnerability in util/icon_browser.php in the Horde Application Framework before 3.3.9 allows remote attackers to inject arbitrary web script or HTML…
–
CVE-2010-3694
Cross-site request forgery (CSRF) vulnerability in the Horde Application Framework before 3.3.9 allows remote attackers to hijack the authentication of unspecified victims for…
–
CVE-2009-3237
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and…
–
CVE-2007-1474
Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files…