CVE-2020-8866

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-8866
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8866.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-8866
Downstream
Published
2020-03-23T21:15:12.643Z
Modified
2026-07-08T05:56:48.571171097Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within add.php. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10125.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_RANGE",
            "vendor_product": "horde:horde_form",
            "extracted_events": [
                {
                    "fixed": "2.0.20"
                }
            ],
            "cpes": [
                "cpe:2.3:a:horde:horde_form:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux",
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                }
            ],
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ]
        }
    ]
}
References

Affected packages

Git / github.com/horde/groupware

Affected ranges

Type
GIT
Repo
https://github.com/horde/groupware
Events
Introduced
cf488bd4e87e1ff0d9e11a5a3c2d2f805172dd70
Last affected
cf488bd4e87e1ff0d9e11a5a3c2d2f805172dd70
Database specific 
{
    "cpe": "cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "5.2.22"
        },
        {
            "last_affected": "5.2.22"
        }
    ]
}

Affected versions

5.*
5.2.22
v5.*
v5.2.22

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8866.json"

Git / github.com/horde/horde

Affected ranges

Type
GIT
Repo
https://github.com/horde/horde
Events
Introduced
da4d701808c3af4100bd1f2d7f0fd07854267fa9
Last affected
da4d701808c3af4100bd1f2d7f0fd07854267fa9
Database specific 
{
    "cpe": "cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "5.2.22"
        },
        {
            "last_affected": "5.2.22"
        }
    ]
}

Affected versions

5.*
5.2.22
webmail-5.*
webmail-5.2.22

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8866.json"