CVE-2008-1284

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-03-11 · updated 2026-06-16
Weakness: CWE-22

Description

Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name.

Affected products

Horde Groupware: through 1.0.4
Horde Groupware Webmail Edition: through 1.0.5
Horde: 3.1.6

References

http://lists.horde.org/archives/announce/2008/000382.html
http://lists.horde.org/archives/announce/2008/000383.html
http://lists.horde.org/archives/announce/2008/000384.html
http://secunia.com/advisories/29286
http://secunia.com/advisories/29374
http://secunia.com/advisories/29400
http://secunia.com/advisories/30047
http://security.gentoo.org/glsa/glsa-200805-01.xml
http://securityreason.com/securityalert/3726
http://www.debian.org/security/2008/dsa-1519
http://www.securityfocus.com/archive/1/489239/100/0/threaded
http://www.securityfocus.com/archive/1/489289/100/0/threaded

Get alerted when CVE-2008-1284 or the next vulnerability affects your stack