CVE-2008-0807
Severity Score
4.9
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book.
lib/Driver/sql.php en Turba 2 (turba2) Contact Manager H3 2.1.x antes de 2.1.7 y 2.2.x antes de 2.2-RC3, como se usa en productos como Horde Groupware antes de 1.0.4 y Horde Groupware Webmail Edition antes de 1.0.5, no comprueba correctamente los privilegios de acceso, lo que permite a usuarios autentificados remotamente modificar datos de dirección a través de un parámetro object_id modificado a edit.php, como se demostró modificando una entrada personal en la libreta de direcciones cuando hay un acceso de escritura a una libreta de direcciones compartida.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2008-02-18 CVE Reserved
- 2008-02-19 CVE Published
- 2024-07-23 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (17)
| URL | Tag | Source |
|---|---|---|
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058 | X_refsource_confirm | |
| http://secunia.com/advisories/29071 | Third Party Advisory | |
| http://secunia.com/advisories/29184 | Third Party Advisory | |
| http://secunia.com/advisories/29185 | Third Party Advisory | |
| http://secunia.com/advisories/29186 | Third Party Advisory | |
| http://www.securitytracker.com/id?1019433 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2008/0593/references | Vdb Entry | |
| https://bugzilla.redhat.com/show_bug.cgi?id=432027 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.horde.org/archives/announce/2008/000378.html | 2011-03-08 | |
| http://lists.horde.org/archives/announce/2008/000379.html | 2011-03-08 | |
| http://lists.horde.org/archives/announce/2008/000380.html | 2011-03-08 | |
| http://lists.horde.org/archives/announce/2008/000381.html | 2011-03-08 | |
| http://www.securityfocus.com/bid/27844 | 2011-03-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | - |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | alpha |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | amd64 |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | arm |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | hppa |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | ia-32 |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | ia-64 |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | m68k |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | mips |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | mipsel |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | powerpc |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | s-390 |
Safe
|
| Horde Search vendor "Horde" | Groupware Search vendor "Horde" for product "Groupware" | 1.0.3 Search vendor "Horde" for product "Groupware" and version "1.0.3" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | sparc |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | - |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | alpha |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | amd64 |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | arm |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | hppa |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | ia-32 |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | ia-64 |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | m68k |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | mips |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | mipsel |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | powerpc |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | s-390 |
Safe
|
| Horde Search vendor "Horde" | Groupware Webmail Edition Search vendor "Horde" for product "Groupware Webmail Edition" | 1.0.4 Search vendor "Horde" for product "Groupware Webmail Edition" and version "1.0.4" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | sparc |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | - |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | alpha |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | amd64 |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | arm |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | hppa |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | ia-32 |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | ia-64 |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | m68k |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | mips |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | mipsel |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | powerpc |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | s-390 |
Safe
|
| Horde Search vendor "Horde" | Turba Contact Manager Search vendor "Horde" for product "Turba Contact Manager" | 2.1.6 Search vendor "Horde" for product "Turba Contact Manager" and version "2.1.6" | - |
Affected
| in | Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | sparc |
Safe
|