Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-7414

In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it.

Published

2017-04-04T14:59:00.337

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: HIGH
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

4.9

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-78
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application horde groupware 5.0.0 Yes
Application horde groupware 5.0.0 Yes
Application horde groupware 5.0.1 Yes
Application horde groupware 5.0.2 Yes
Application horde groupware 5.0.3 Yes
Application horde groupware 5.0.4 Yes
Application horde groupware 5.0.5 Yes
Application horde groupware 5.1.0 Yes
Application horde groupware 5.1.0 Yes
Application horde groupware 5.1.1 Yes
Application horde groupware 5.1.2 Yes
Application horde groupware 5.1.3 Yes
Application horde groupware 5.1.4 Yes
Application horde groupware 5.1.5 Yes
Application horde groupware 5.2.0 Yes
Application horde groupware 5.2.0 Yes
Application horde groupware 5.2.1 Yes
Application horde groupware 5.2.2 Yes
Application horde groupware 5.2.3 Yes
Application horde groupware 5.2.4 Yes
Application horde groupware 5.2.5 Yes
Application horde groupware 5.2.6 Yes
Application horde groupware 5.2.7 Yes
References