Vulnerability Description
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Horde | Groupware | <= 5.2.17 |
Related Weaknesses (CWE)
References
- https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html
- https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.htmlMailing ListVendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html
- https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.htmlMailing ListVendor Advisory
FAQ
What is CVE-2017-7413?
CVE-2017-7413 is a vulnerability with a CVSS score of 8.8 (HIGH). In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled ...
How severe is CVE-2017-7413?
CVE-2017-7413 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-7413?
Check the references section above for vendor advisories and patch information. Affected products include: Horde Groupware.