CVE-2022-30287: High severity Horde Groupware vulnerability
Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/php-horde-turbato a version that resolves this vulnerability.Fixed in 4.2.29-2 - Upgrade
Upgrade
debian/php-horde-turbato a version that resolves this vulnerability.Fixed in 4.2.25-6
Event History
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2022-30287.
What is the title of this vulnerability?
The title of this vulnerability is Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack.
What is the severity level of CVE-2022-30287?
The severity level of CVE-2022-30287 is high.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by performing a reflection injection attack to instantiate a driver class, which leads to arbitrary deserialization of PHP objects.
How can I fix CVE-2022-30287?
To fix CVE-2022-30287, it is recommended to update Horde Groupware Webmail Edition to a version beyond 5.2.22.