NVD

Id
50441  
Name
CVE-2009-3236  
Description
The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; reuses temporary filenames during the upload process which allows remote attackers, with privileges to write to the address book, to overwrite arbitrary files and execute PHP code via crafted Horde_Form_Type_image form field elements.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2009-09-17  
Modified Date
2011-04-05  
Seq
2009-3236  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
255158 50441 CVE-2009-3236 [horde-announce] 20090914 [announce] [SECURITY] Horde 3.2.5 (final)  View
255159 50441 CVE-2009-3236 [horde-announce] 20090914 [announce] Horde Groupware 1.1.6 (final)  View
255160 50441 CVE-2009-3236 [horde-announce] 20090914 [announce] Horde Groupware Webmail Edition 1.1.6 (final)  View
255161 50441 CVE-2009-3236 [horde-announce] 20090914 [announce] [SECURITY] Horde 3.3.5 (final)  View
255162 50441 CVE-2009-3236 [horde-announce] 20090914 [announce] Horde Groupware 1.2.4 (final)  View
255163 50441 CVE-2009-3236 [horde-announce] 20090914 [announce] Horde Groupware Webmail Edition 1.2.4 (final)  View
255164 50441 CVE-2009-3236 DSA-1897  View
255165 50441 CVE-2009-3236 horde-application-form-file-overwrite(53202)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
43946 JVNDB-2009-004953 Horde Application Framework などの form ライブラリにおける PHP コードを実行される脆弱性 Horde Application Framework、Groupware および Groupware Webmail Edition の form ライブラリには、アップロードプロセスの間に一時ファイル名を再利用するため、アドレスブックへの書き込みをされる、任意ファイルの上書きをされる、および PHP コードを実行される脆弱性が存在します。 CVE-2009-3236 40667 CVE-2009-3236 50441 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-004953.html 2009-09-17 2012-09-25 View