Object Injection Vulnerability in Horde Util Library
CVE-2014-1691

Currently unrated

Key Information:

Vendor

Horde

Status
Horde Application Framework
Vendor
CVE Published:
1 April 2014

What is CVE-2014-1691?

In versions of the Horde framework prior to 5.1.1, a vulnerability exists within the Util library's handling of serialized objects. This security flaw allows remote attackers to exploit object injection attacks, potentially leading to the execution of arbitrary PHP code. By crafting a malicious serialized object in the _formvars form, an attacker can manipulate the application to execute unintended commands, significantly impacting the security integrity of the affected system.

References

https://github.com/horde/horde/blob/82c400788537cfc0106b6...
x_refsource_CONFIRM
http://seclists.org/oss-sec/2014/q1/156
mailing-listx_refsource_MLIST
http://seclists.org/oss-sec/2014/q1/153
mailing-listx_refsource_MLIST

EPSS Score

42% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.