CVE-2007-6018

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message.

IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, y Horde Groupware Webmail Edition 1.0.3 no validan peticiones HTTP no especificadas, lo cual permite a atacantes remotos (1) borrar mensajes de correo electrónico de su elección mediante un ID numérico modificado o (2) "purgar" correos electrónicos eliminados mediante un mensaje de correo electrónico manipulado.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-11-19 CVE Reserved
2008-01-11 CVE Published
2024-08-07 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (19)

URL	Tag	Source
http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17&r2=1.17.2.1&ty=h	X_refsource_confirm
http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12&r2=1.12.2.1&ty=h	X_refsource_confirm
http://lists.horde.org/archives/announce/2008/000360.html	Mailing List
http://lists.horde.org/archives/announce/2008/000365.html	Mailing List
http://lists.horde.org/archives/announce/2008/000366.html	Mailing List
http://secunia.com/advisories/28546	Third Party Advisory
http://secunia.com/advisories/29184	Third Party Advisory
http://secunia.com/advisories/29185	Third Party Advisory
http://secunia.com/advisories/29186	Third Party Advisory
http://secunia.com/advisories/34418	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=428625	X_refsource_confirm
https://exchange.xforce.ibmcloud.com/vulnerabilities/39595	Vdb Entry

URL	Date	SRC

URL	Date	SRC
http://www.securityfocus.com/bid/27223	2017-07-29

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html	2017-07-29
http://secunia.com/advisories/28020	2017-07-29
http://secunia.com/secunia_research/2007-102/advisory	2017-07-29
http://www.debian.org/security/2008/dsa-1470	2017-07-29
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html	2017-07-29
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html	2017-07-29

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Horde Search vendor "Horde"		Framework Search vendor "Horde" for product "Framework"				3.1.5 Search vendor "Horde" for product "Framework" and version "3.1.5"		-		Affected
Horde Search vendor "Horde"		Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition"				1.0.3 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.3"		-		Affected
Horde Search vendor "Horde"		Horde Search vendor "Horde" for product "Horde"				3.1.5 Search vendor "Horde" for product "Horde" and version "3.1.5"		-		Affected
Horde Search vendor "Horde"		Imp Search vendor "Horde" for product "Imp"				4.1.5 Search vendor "Horde" for product "Imp" and version "4.1.5"		-		Affected