CVE-2019-9858

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-9858
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9858.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-9858
Downstream
Published
2019-05-29T17:29:00.633Z
Modified
2026-07-08T05:53:31.309307173Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the HordeFormTypeimage method onSubmit() is called on uploads, it invokes the functions getImage() and getUpload(), which uses unsanitized user input as a path to save the image. The unsanitized POST parameter object[photo][img][file] is saved in the $upload[img][file] PHP variable, allowing an attacker to manipulate the $tmpfile passed to moveuploaded_file() to save the uploaded file. By setting the parameter to (for example) ../usr/share/horde/static/bd.php, one can write a PHP backdoor inside the web root. The static/ destination folder is a good candidate to drop the backdoor because it is always writable in Horde installations. (The unsanitized POST parameter went probably unnoticed because it's never submitted by the forms, which default to securely using a random path.)

Database specific 
{
    "unresolved_ranges": [
        {
            "vendor_product": "debian:debian_linux",
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                }
            ],
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "vendor_product": "horde:groupware",
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "5.2.17"
                },
                {
                    "last_affected": "5.2.17"
                }
            ],
            "cpes": [
                "cpe:2.3:a:horde:groupware:5.2.17:*:*:*:webmail:*:*:*"
            ]
        }
    ]
}
References

Affected packages

Git / github.com/horde/groupware

Affected ranges

Type
GIT
Repo
https://github.com/horde/groupware
Events
Introduced
c1cd50df760cf435ea1e5837eb160053a90b3bca
Last affected
cf488bd4e87e1ff0d9e11a5a3c2d2f805172dd70
Database specific
Show details 
{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:horde:groupware:5.2.17:*:*:*:webmail:*:*:*",
        "cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "5.2.17"
        },
        {
            "last_affected": "5.2.17"
        },
        {
            "introduced": "5.2.22"
        },
        {
            "last_affected": "5.2.22"
        }
    ]
}

Affected versions

5.*
5.2.17
5.2.22

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9858.json"

Git / github.com/horde/horde

Affected ranges

Type
GIT
Repo
https://github.com/horde/horde
Events
Introduced
9abb7d4b9491bec1a756a3aeba59f7940a843508
Last affected
da4d701808c3af4100bd1f2d7f0fd07854267fa9
Database specific
Show details 
{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:horde:groupware:5.2.17:*:*:*:webmail:*:*:*",
        "cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "5.2.17"
        },
        {
            "last_affected": "5.2.17"
        },
        {
            "introduced": "5.2.22"
        },
        {
            "last_affected": "5.2.22"
        }
    ]
}

Affected versions

5.*
5.2.17
5.2.22

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9858.json"