CVEvulnerability

CVE-2008-1284

6.0 MEDIUM Published 2008-03-11 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-03-11
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
CWE-22

Description

Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name.

Affected configurations

• horde groupware (<= 1.0.4) • horde groupware webmail edition (<= 1.0.5) • horde horde 3.1.6

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

Referenced by CWE · observed example (2)

  • CWE-158 Improper Neutralization of Null Byte or NUL Character weakness
  • CWE-20 Improper Input Validation weakness

References