NVD

Id
28344  
Name
CVE-2015-7984  
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php, (2) SQL queries via the sql parameter to admin/sqlshell.php, or (3) PHP code via the php parameter to admin/phpshell.php.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-11-19  
Modified Date
2016-12-07  
Seq
2015-7984  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
148972 28344 CVE-2015-7984 [announce] 20151021 [SECURITY] Horde 5.2.8 (final)  View
148973 28344 CVE-2015-7984 [announce] 20151022 [SECURITY] Horde Groupware 5.2.11 (final)  View
148974 28344 CVE-2015-7984 [announce] 20151022 [SECURITY] Horde Groupware Webmail Edition 5.2.11 (final)  View
148975 28344 CVE-2015-7984 DSA-3391  View
148976 28344 CVE-2015-7984 38765  View
148977 28344 CVE-2015-7984 https://www.htbridge.com/advisory/HTB23272  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
10673 JVNDB-2015-005993 複数の Horde 製品におけるクロスサイトリクエストフォージェリの脆弱性 Horde、Horde Groupware、および Horde Groupware Webmail Edition には、クロスサイトリクエストフォージェリの脆弱性が存在します。 CVE-2015-7984 85209 CVE-2015-7984 28344 6.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-005993.html 2015-10-21 2015-11-24 View