ByteOS Network

NVD Vulnerability Details :

CVE-2017-7414

Deferred

Source-cve@mitre.org

Published At-04 Apr, 2017 | 14:59

Updated At-20 Apr, 2025 | 01:37

In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	7.5	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	5.1	MEDIUM	AV:N/AC:H/Au:N/C:P/I:P/A:P

Hyperlink	Source	Resource
https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html	cve@mitre.org	N/A
https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.html	cve@mitre.org	Mailing List Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History