Cross-Site Request Forgery in Horde Trean Affects Horde Groupware Webmail Edition
CVE-2019-12095
8.8HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2019-12095?
Horde Trean, utilized in versions of Horde Groupware Webmail Edition up to 5.2.22, is vulnerable to Cross-Site Request Forgery (CSRF). This vulnerability can be exploited using the treanBookmarkTags parameter in a request to the trean/ URI on a webmail server. An attacker may leverage this flaw to submit unauthorized commands, potentially leading to stored XSS payload execution or other malicious actions. It is essential for users of Horde products to assess their exposure and implement necessary measures to mitigate this security threat.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.