CVE-2008-1284

Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name.

CVSS v2.0

6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

EPSS

1.68% chance of exploitation in the next 30 days, 75th percentile

Published

2008-03-11

Updated

2024-08-07

Proof-of-concept exploits (2)

• http://www.securityfocus.com/archive/1/489239/100/0/threaded
• http://www.securityfocus.com/archive/1/489289/100/0/threaded

References

• CVE Record
• NVD entry

Related

• CVE-2008-1283
• CVE-2008-1289
• CVE-2008-1281
• CVE-2008-1295
• CVE-2008-1278
• CVE-2008-1296