Vulnerability · Published Mar 23, 2020 · Assigned by zdi

CVE-2020-8865

Medium 6.3

In plain English

A medium-severity security flaw in Groupware Webmail Edition from Horde. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.8% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)6.3Medium

Exploit odds (30 days)6.8%top 6.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the params[template] parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10469.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	php-horde-trean	1.1.10-1	DEBIAN-CVE-2020-8865

Affected products (as reported)

Vendor	Product	Versions
Horde	Groupware Webmail Edition	5.2.22

Weakness: CWE-23 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://www.zerodayinitiative.com/advisories/ZDI-20-276/ x_refsource_MISC
[debian-lts-announce] 20200415 [SECURITY] [DLA 2175-1] php-horde-trean security update mailing-list, x_refsource_MLIST