File Overwrite Vulnerability in Horde Application Framework and Groupware Products
CVE-2009-3236

Currently unrated

Key Information:

Vendor

Horde

Status
Groupware
Application Framework
Vendor
CVE Published:
17 September 2009

What is CVE-2009-3236?

A vulnerability exists in the Horde Application Framework and related products due to improper handling of temporary filenames during file uploads. This allows authorized remote attackers with write access to the address book to overwrite arbitrary files and potentially execute PHP code through specially crafted Horde_Form_Type_image form fields. Users of affected versions are strongly advised to upgrade to the latest releases to mitigate this risk.

References

http://www.osvdb.org/58107
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/36882
third-party-advisoryx_refsource_SECUNIA
http://marc.info/?l=horde-announce&m=125294558611682&w=2
mailing-listx_refsource_MLIST

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.