CVE-2017-7414: horde groupware OS Command Injection
Vulnerability summary
CVE-2017-7414 is a high (CVSS 7.5) OS Command Injection vulnerability in horde groupware. EPSS estimates a 1.18% chance of exploitation in the next 30 days, higher than 67.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 04-04-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.18%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
-0.07 pp
From 1.25% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- php-horde-crypt< 2.7.5-2
Horde1 product
- groupware5.0.0 | 5.0.0:rc1 | 5.0.1 | 5.0.2 | 5.0.3 | 5.0.4 | 5.0.5 | 5.1.0 | 5.1.0:rc1 | 5.1.1 | 5.1.2 | 5.1.3 | 5.1.4 | 5.1.5 | 5.2.0 | 5.2.0:rc1 | 5.2.1 | 5.2.2 | 5.2.3 | 5.2.4 | 5.2.5 | 5.2.6 | 5.2.7
Ubuntu1 product
- php-horde-cryptAll versions (No fix recorded)
3 vendors · 3 products
References
5 links- lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.htmlX Refsource CONFIRMMailing ListVendor AdvisoryREPORT
