VULNERABILITY INTELLIGENCE

CVE-2017-7413

CVSS score8.8 HIGH
EPSS probability39.18%
CISA KEVNot currently listed
Published2017-04-04
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.

Weakness classification

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Primary references