Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
CVE-2008-0807
CVE information
Published
Last Modified
CVSSv2.0 Severity
Impact Analysis
Description
lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book..
CVSSv2.0 Score
- Severity
- Medium
- Base Score
- 4.9/10
- Exploit Score
- 6.8/10
- Access Vector
- Network
- Access Complexity
- Medium
- Authentication Required
- Single
- Impact Score
- 4.9/10
- Confidentiality Impact
- Partial
- Availability Impact
- None
- Integrity Impact
- Partial
Products Affected
CPE | Affected | Vulnerable | Excluding | Edit |
---|---|---|---|---|
cpe:2.3:o:debian:debian_linux:4.0:*:ia-32:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:alpha:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:amd64:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:mipsel:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:m68k:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:sparc:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:arm:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:ia-64:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:hppa:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:s-390:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:mips:*:*:*:*:* |
No
|
- | ||
cpe:2.3:o:debian:debian_linux:4.0:*:powerpc:*:*:*:*:* |
No
|
- | ||
cpe:2.3:a:horde:groupware:1.0.3:*:*:*:*:*:*:* |
Yes
|
- | ||
cpe:2.3:a:horde:groupware_webmail_edition:1.0.4:*:*:*:*:*:*: |
Yes
|
- | ||
cpe:2.3:a:horde:turba_contact_manager:2.1.6:*:*:*:*:*:*:* |
Yes
|
- |
References
- http://lists.horde.org/archives/announce/2008/000380.html
- http://lists.horde.org/archives/announce/2008/000381.html
- http://lists.horde.org/archives/announce/2008/000379.html
- http://lists.horde.org/archives/announce/2008/000378.html
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058
- http://www.securityfocus.com/bid/27844
- http://secunia.com/advisories/28982
- http://www.debian.org/security/2008/dsa-1507
- http://www.securitytracker.com/id?1019433
- http://secunia.com/advisories/29071
- https://bugzilla.redhat.com/show_bug.cgi?id=432027
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html
- http://secunia.com/advisories/29184
- http://secunia.com/advisories/29185
- http://secunia.com/advisories/29186
- http://www.vupen.com/english/advisories/2008/0593/references