FKIE_CVE-2017-7414

Vulnerability from fkie_nvd - Published: 2017-04-04 14:59 - Updated: 2025-04-20 01:37
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it.
References
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2018/06/msg00006.html
cve@mitre.orghttps://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.htmlMailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html
af854a3a-2127-422b-91ae-364da2661108https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.htmlMailing List, Vendor Advisory
Impacted products
Vendor Product Version
horde groupware 5.0.0
horde groupware 5.0.0
horde groupware 5.0.1
horde groupware 5.0.2
horde groupware 5.0.3
horde groupware 5.0.4
horde groupware 5.0.5
horde groupware 5.1.0
horde groupware 5.1.0
horde groupware 5.1.1
horde groupware 5.1.2
horde groupware 5.1.3
horde groupware 5.1.4
horde groupware 5.1.5
horde groupware 5.2.0
horde groupware 5.2.0
horde groupware 5.2.1
horde groupware 5.2.2
horde groupware 5.2.3
horde groupware 5.2.4
horde groupware 5.2.5
horde groupware 5.2.6
horde groupware 5.2.7
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.0.0:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "74C2C13C-0014-4E45-B459-50B7005C828D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.0.0:rc1:*:*:webmail:*:*:*",
              "matchCriteriaId": "3C63CC65-6B19-4B8D-A4DC-3B0C3055E8A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.0.1:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "A09D1D89-A623-442E-9261-F58031BB517D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.0.2:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "6C36F237-9CBF-4E9E-A1DF-ABCB0187E725",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.0.3:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "9103D5DE-E24A-476F-AEE9-68E3736E1C7E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.0.4:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "2F5106E5-050E-443C-9A67-0210AA01FE35",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.0.5:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "0ABE42CD-F4E3-4255-985D-6AC712231134",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.1.0:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "693E0F58-A378-4A85-94B1-66709A557623",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.1.0:rc1:*:*:webmail:*:*:*",
              "matchCriteriaId": "FB8CD370-1B28-4E95-A357-C0476458A0F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.1.1:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "D3203790-5230-4F8F-AE5E-F2D48B0B1767",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.1.2:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "36EBEA90-C1D6-4AFE-B04D-F085986F8B92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.1.3:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "3E2F5341-D61A-4FDB-99DE-4B65B6F333C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.1.4:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "4ADEB382-91FB-4664-9569-BFBBFD0577D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.1.5:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "A74B6B18-FFD3-4B38-B828-84178B0BEA4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.2.0:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "2D8D3E4C-4AE6-4168-9865-8D3D19746B45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.2.0:rc1:*:*:webmail:*:*:*",
              "matchCriteriaId": "427CB5A7-2344-4BF2-A741-1E0A6A4972AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.2.1:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "E6A8F086-D6B2-4CFB-8493-C40707E8E04D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.2.2:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "C08B8F45-34B5-46C7-B333-20413E8B4AA8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.2.3:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "7D963CE7-E4DD-4FFE-83A0-39D465B9B59C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.2.4:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "D12CBE60-F694-44C2-91E5-4676D7F80168",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.2.5:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "601DED27-8DD8-4B8E-89A9-1A883594D237",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.2.6:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "E47C6EF6-5006-40D6-BEFD-AEAE61200711",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:5.2.7:*:*:*:webmail:*:*:*",
              "matchCriteriaId": "E6670DC6-A5F2-4C70-A13F-012125B71012",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user\u0027s preferences, and has enabled the \"Should PGP signed messages be automatically verified when viewed?\" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it."
    },
    {
      "lang": "es",
      "value": "En Horde_Crypt en versiones anteriores a 2.7.6, como se utiliza en Horde Groupware Webmail Edition 5.x hasta la versi\u00f3n 5.2.17, OS puede ocurrir si el usuario tiene activadas las caracter\u00edsticas de PGP en las preferencias del usuario y ha activado la preferencia \"\u00bfDeber\u00edan verificarse autom\u00e1ticamente los mensajes firmados de PGP cuando se visualizan?\". Para aprovechar esta vulnerabilidad, un atacante puede enviar un correo electr\u00f3nico firmado por PGP (que se ha creado de manera malintencionada) al usuario de la Horda, que debe verlo o visualizarlo."
    }
  ],
  "id": "CVE-2017-7414",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-04-04T14:59:00.337",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.