CVEvulnerability

CVE-2022-30287

8.0 HIGH Published 2022-07-28 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-07-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-470, CWE-502

Description

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.

Affected configurations

• horde groupware (<= 5.2.22) • debian debian linux 10.0

Related

Weakness · CWE (2)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References