CVE-2017-7414

In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled…

published April 4, 2017

CVSS
—
EPSS
1%
Percentile
67.2
In the wild
Unconfirmed
What it is

In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01180 · 67.2th percentile
Published
2017-04-04T14:00Z
EPSS history
Timeline
  • 04 APR 14:00Z
    In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled…
    cvelistv5