CVEvulnerability
CVE-2008-0807
4.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-02-19
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.9 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-264
Description
lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book.
Affected configurations
• horde groupware 1.0.3
• horde groupware webmail edition 1.0.4
• horde turba contact manager 2.1.6
Related
Weakness · not in database (1)
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058 bugs.debian.org
- http://lists.horde.org/archives/announce/2008/000378.html Patch
- http://lists.horde.org/archives/announce/2008/000379.html Patch
- http://lists.horde.org/archives/announce/2008/000380.html Patch
- http://lists.horde.org/archives/announce/2008/000381.html Patch
- http://secunia.com/advisories/28982 Vendor Advisory
- http://secunia.com/advisories/29071 secunia.com
- http://secunia.com/advisories/29184 secunia.com
- http://secunia.com/advisories/29185 secunia.com
- http://secunia.com/advisories/29186 secunia.com
- http://www.debian.org/security/2008/dsa-1507 www.debian.org
- http://www.securityfocus.com/bid/27844 Patch
- http://www.securitytracker.com/id?1019433 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/0593/references www.vupen.com
- https://bugzilla.redhat.com/show_bug.cgi?id=432027 bugzilla.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html www.redhat.com
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058 bugs.debian.org
- http://lists.horde.org/archives/announce/2008/000378.html Patch
- http://lists.horde.org/archives/announce/2008/000379.html Patch
- http://lists.horde.org/archives/announce/2008/000380.html Patch
- http://lists.horde.org/archives/announce/2008/000381.html Patch
- http://secunia.com/advisories/28982 Vendor Advisory
- http://secunia.com/advisories/29071 secunia.com
- http://secunia.com/advisories/29184 secunia.com
- http://secunia.com/advisories/29185 secunia.com
- http://secunia.com/advisories/29186 secunia.com
- http://www.debian.org/security/2008/dsa-1507 www.debian.org
- http://www.securityfocus.com/bid/27844 Patch
- http://www.securitytracker.com/id?1019433 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/0593/references www.vupen.com
- https://bugzilla.redhat.com/show_bug.cgi?id=432027 bugzilla.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html www.redhat.com