CVE-2020-8866CWE-434

This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22

Medium · published March 23, 2020

CVSS v3.0
4.3
EPSS
10%
Percentile
95.5
In the wild
Unconfirmed
What it is

This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within add.php. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10125.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.09579 · 95.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2020-03-23T20:15Z
EPSS history
Timeline
  • 23 MAR 20:15Z
    This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22
    cvelistv5