CVE-2007-1474: Medium severity Horde Horde Application Framework vulnerability

Published Mar 16, 2007

Updated

Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames.

Affected Software

24 affected components

Horde Horde Application Framework=3.0.0

Horde Horde Application Framework=3.0.4

Horde Horde Application Framework=3.1.3

Horde IMP=2.0

Horde IMP=2.2

Horde IMP=2.2.1

Horde IMP=2.2.2

Horde IMP=2.2.3

Horde IMP=2.2.4

Horde IMP=2.2.5

Horde IMP=2.2.6

Horde IMP=2.2.7

Horde IMP=2.2.8

Horde IMP=2.3

Horde IMP=3.0

Horde IMP=3.1

Horde IMP=3.1.2

Horde IMP=3.2

Horde IMP=3.2.1

Horde IMP=3.2.2

Horde IMP=3.2.3

Horde IMP=3.2.4

Horde IMP=3.2.5

Horde IMP=3.2.6

Remediation

Patch Available

http://lists.horde.org/archives/announce/2007/000315.html

Event History

Mar 16, 2007

CVE Published

09:19 PM

Mar 17, 2007

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1474?

CVE-2007-1474 is considered a moderate severity vulnerability as it allows local users to delete arbitrary files.

How do I fix CVE-2007-1474?

To fix CVE-2007-1474, upgrade to Horde Application Framework version 3.1.4 or later.

Which versions of Horde are affected by CVE-2007-1474?

CVE-2007-1474 affects Horde IMP versions 2.0 to 2.2.8 and 3.0 to 3.2.6, along with Horde Application Framework versions 3.0.0 to 3.1.3.

What is the impact of CVE-2007-1474?

The impact of CVE-2007-1474 allows local users to potentially gain elevated privileges by deleting arbitrary files.

Who can exploit CVE-2007-1474?

CVE-2007-1474 can be exploited by local users who have access to the cleanup cron script.