CVE Feed

    Dashboard / CVE / CVE-2009-0932

    CVE-2009-0932

    Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name.

    Published:Jan 27, 2009
    Last Modified:Apr 23, 2026
    EPS:Mar 17, 2009
    EPSS Score:0.05612
    CVSS Score:6.4

    Affected Products

    Vendor
    Debian
    Product
    Horde
    Vendor
    Debian
    Product
    Horde Groupware

    Exploits

    https://www.exploit-db.com/exploits/16154

    References

    http://cvs.horde.org/co.php/groupware/docs/groupware/CHANGES?r=1.28.2.5
    http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.413.2.5
    http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.503
    http://lists.horde.org/archives/announce/2009/000482.html
    http://lists.horde.org/archives/announce/2009/000483.html
    http://lists.horde.org/archives/announce/2009/000486.html
    http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
    http://secunia.com/advisories/33695
    http://secunia.com/advisories/34418
    http://secunia.com/advisories/34609
    http://securityreason.com/securityalert/8077
    http://www.securityfocus.com/bid/33491
    http://cvs.horde.org/co.php/groupware/docs/groupware/CHANGES?r=1.28.2.5
    http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.413.2.5
    http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.503
    http://lists.horde.org/archives/announce/2009/000482.html
    http://lists.horde.org/archives/announce/2009/000483.html
    http://lists.horde.org/archives/announce/2009/000486.html
    http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
    http://secunia.com/advisories/33695
    http://secunia.com/advisories/34418
    http://secunia.com/advisories/34609
    http://securityreason.com/securityalert/8077
    http://www.securityfocus.com/bid/33491

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High