fkie_cve-2009-3236
Vulnerability from fkie_nvd
Published
2009-09-17 10:30
Modified
2025-04-09 00:30
Severity ?
Summary
The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; reuses temporary filenames during the upload process which allows remote attackers, with privileges to write to the address book, to overwrite arbitrary files and execute PHP code via crafted Horde_Form_Type_image form field elements.
References
cve@mitre.orghttp://marc.info/?l=horde-announce&m=125291625030436&w=2Patch
cve@mitre.orghttp://marc.info/?l=horde-announce&m=125292088004087&w=2Patch
cve@mitre.orghttp://marc.info/?l=horde-announce&m=125292314007049&w=2Patch
cve@mitre.orghttp://marc.info/?l=horde-announce&m=125292339907481&w=2Patch
cve@mitre.orghttp://marc.info/?l=horde-announce&m=125294558611682&w=2Patch
cve@mitre.orghttp://marc.info/?l=horde-announce&m=125295852706029&w=2Patch
cve@mitre.orghttp://secunia.com/advisories/36665Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/36882Vendor Advisory
cve@mitre.orghttp://www.debian.org/security/2009/dsa-1897
cve@mitre.orghttp://www.osvdb.org/58107
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/53202
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=horde-announce&m=125291625030436&w=2Patch
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=horde-announce&m=125292088004087&w=2Patch
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=horde-announce&m=125292314007049&w=2Patch
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=horde-announce&m=125292339907481&w=2Patch
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=horde-announce&m=125294558611682&w=2Patch
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=horde-announce&m=125295852706029&w=2Patch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36665Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36882Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1897
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/58107
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/53202
Impacted products
Vendor Product Version
horde application_framework 3.2
horde application_framework 3.2.1
horde application_framework 3.2.2
horde application_framework 3.2.3
horde application_framework 3.2.4
horde application_framework 3.3
horde application_framework 3.3.1
horde application_framework 3.3.2
horde application_framework 3.3.3
horde application_framework 3.3.4
horde groupware 1.1
horde groupware 1.1.1
horde groupware 1.1.2
horde groupware 1.1.3
horde groupware 1.1.4
horde groupware 1.1.5
horde groupware 1.2
horde groupware 1.2
horde groupware 1.2.1
horde groupware 1.2.2
horde groupware 1.2.3
horde groupware 1.1
horde groupware 1.1
horde groupware 1.1
horde groupware 1.1
horde groupware 1.1
horde groupware 1.1.1
horde groupware 1.1.2
horde groupware 1.1.3
horde groupware 1.1.4
horde groupware 1.1.5
horde groupware 1.2
horde groupware 1.2
horde groupware 1.2.1
horde groupware 1.2.2
horde groupware 1.2.3
horde groupware 1.2.3


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:horde:application_framework:3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1F91CDA-B425-4DB2-89E4-12267B600D13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:application_framework:3.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A8BB743-A760-4C72-880C-759E54FB7CF1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:application_framework:3.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "89477FCC-C925-418A-A3FF-F5B02736600C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:application_framework:3.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5862181-4CE7-452F-8877-41E099440188",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:application_framework:3.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3E601FE-94F1-48AD-A0F2-42824A3A4FC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:application_framework:3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDE2B06C-EDBD-4FA1-90AA-148E39EF5AE4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:application_framework:3.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5CF33A8-C497-4C86-8C5D-7181597BEC53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:application_framework:3.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "30B312DB-14BE-425C-9B07-0CBED6F39E2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:application_framework:3.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2CF2865-CA12-4C4C-9BEC-7A97E6AAB377",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:application_framework:3.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF389AE4-D2AD-4992-BFBD-68FB1CBEE50B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6BBB036-494E-41D4-BD04-40906FAB5C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C10E681-5D2B-4EA4-B8E1-C0CA4FC9D3FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "19CC5154-42C5-4877-9147-5DFD61BD5CDC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "62AAEBBF-1696-4EAC-8837-68A03C2D2F5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F626876D-99FC-4DE0-BEE0-35874C4E25F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "A849DD3E-882A-4621-BB6C-315A76677BB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB711B5E-9011-4BA2-917A-DB8545705E23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.2:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "50DC1068-F426-497F-A5A0-E032BC3816F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2C5A176-8C72-40EA-85AC-F11B40FD53A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB4C3487-4556-47E5-8BF3-1DEDF0E9AFEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "78F24E43-491B-4AD1-B905-66F7FC6DA98D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6BBB036-494E-41D4-BD04-40906FAB5C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "37B76B27-ADF0-4E88-B92C-304FB38A356E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "965F245A-879A-4DF0-ABC5-588E78C4CBBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "3DCB29F9-3875-4264-8117-5751FEDC3350",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "59FC250F-EF0B-4604-99A2-3EEB8B2DEB77",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C10E681-5D2B-4EA4-B8E1-C0CA4FC9D3FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "19CC5154-42C5-4877-9147-5DFD61BD5CDC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "62AAEBBF-1696-4EAC-8837-68A03C2D2F5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F626876D-99FC-4DE0-BEE0-35874C4E25F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "A849DD3E-882A-4621-BB6C-315A76677BB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB711B5E-9011-4BA2-917A-DB8545705E23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.2:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "50DC1068-F426-497F-A5A0-E032BC3816F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2C5A176-8C72-40EA-85AC-F11B40FD53A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB4C3487-4556-47E5-8BF3-1DEDF0E9AFEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "78F24E43-491B-4AD1-B905-66F7FC6DA98D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:groupware:1.2.3:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "F577A169-8354-4218-B3C6-04DA4BDF1E3C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; reuses temporary filenames during the upload process which allows remote attackers, with privileges to write to the address book, to overwrite arbitrary files and execute PHP code via crafted Horde_Form_Type_image form field elements."
    },
    {
      "lang": "es",
      "value": "La biblioteca de formularios en Horde Application Framework versi\u00f3n 3.2 anterior a 3.2.5 y versi\u00f3n 3.3 anterior a 3.3.5; Groupware versi\u00f3n 1.1 anterior a 1.1.6 y versi\u00f3n 1.2 anterior a 1.2.4; y Groupware Webmail Edition versi\u00f3n 1.1 anterior a 1.1.6 y versi\u00f3n 1.2 anterior a 1.2.4; reutiliza los nombres de archivo temporales durante el proceso de carga, lo que permite a los atacantes remotos, con privilegios para escribir en la libreta de direcciones, sobrescribir archivos arbitrarios y ejecutar c\u00f3digo PHP por medio de elementos de campo de formulario Horde_Form_Type_image creados."
    }
  ],
  "id": "CVE-2009-3236",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-09-17T10:30:01.360",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125291625030436\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125292088004087\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125292314007049\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125292339907481\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125294558611682\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125295852706029\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36665"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36882"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2009/dsa-1897"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/58107"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53202"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125291625030436\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125292088004087\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125292314007049\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125292339907481\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125294558611682\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=horde-announce\u0026m=125295852706029\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36665"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36882"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2009/dsa-1897"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/58107"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53202"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.