CVE-2012-0209: horde groupware Code Injection
Vulnerability summary
CVE-2012-0209 is a high (CVSS 7.5) Code Injection vulnerability in horde groupware. EPSS estimates a 71.90% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 6 public exploits are recorded.
Timeline
- 25-09-2012PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers to execute arbitrary PHP code.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
71.90%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 71.90% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
6 foundExploit Reference (dev.horde.org)
Maturity: unknown
Exploit Reference (eromang.zataz.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.org)
Maturity: unknown
Show all 6 exploits
Exploit Reference (lists.horde.org)
Maturity: unknown
Horde 3.3.12 - Backdoor Arbitrary PHP Code Execution (Metasploit)
Maturity: weaponized
Horde 3.3.12 Backdoor Arbitrary PHP Code Execution
exploit/multi/http/horde_href_backdoor
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
1 vendor · 2 products
References
5 links- dev.horde.org/h/jonah/stories/view.php?channel_id=1&id=155X Refsource CONFIRMExploitPatchVendor Advisory
- packetstormsecurity.org/files/109874/Horde-3.3.12-Backdoor-Arbitrary-PHP-Code-Execution.htmlX Refsource MISCExploit