CVE-2025-41066: Disclosure of sensitive information in Horde Groupware
Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the parameters ‘id’ and ‘u’. If the specified user exists, the server will return the download of an empty file; if it does not exist, no download will be initiated, which unequivocally reveals the validity of the user.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41066?
CVE-2025-41066 is considered a medium severity vulnerability due to its potential for user enumeration by unauthenticated attackers.
How do I fix CVE-2025-41066?
To remediate CVE-2025-41066, it is recommended to update Horde Groupware to the latest version that addresses this user enumeration vulnerability.
What are the implications of exploiting CVE-2025-41066?
Exploiting CVE-2025-41066 allows attackers to determine the existence of valid user accounts, which can lead to further attacks.
Who is affected by CVE-2025-41066?
CVE-2025-41066 affects users of Horde Groupware versions prior to the fix, allowing unauthorized account discovery.
Is CVE-2025-41066 easy to exploit?
Yes, CVE-2025-41066 can be exploited easily by sending a specifically crafted HTTP request.