High severity · published Sep 21, 2017
CVE-2017-14650
A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility
8.1
CVSS
4%
EPSS
No
On KEV
Description
A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility. It's not exploitable through any Horde application, because the code path to the vulnerability is not used by any Horde code. Custom applications using the Horde_Image library might be affected. This vulnerability affects all versions of Horde_Image from 2.0.0 to 2.5.1, and is fixed in 2.5.2. The problem is missing input validation of the index field in _raw() during construction of an ImageMagick command line.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HI
Horde Image Api · Horde
2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.1; 2.0.2; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-14650
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-14650
Mailing List
http://www.openwall.com/lists/oss-security/2017/09/21/4
Exploit
https://github.com/horde/horde/commit/eb3afd14c22c77ae0d29e2848f5ac726ef6e7c5b
Mailing List
https://marc.info/?l=horde-announce&m=150600299528079&w=2
www.debian.org
https://www.debian.org/security/2018/dsa-4276
More from Horde Image Api
8.8
CVE-2017-9774
Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request