CVE-2020-8518: debian debian_linux Code Injection
Vulnerability summary
CVE-2020-8518 is a critical (CVSS 9.8) Code Injection vulnerability in debian debian_linux. EPSS estimates a 71.73% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 17-02-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
71.73%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 71.73% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Horde Groupware Webmail Edition 5.2.22 - Remote Code Execution
Maturity: poc
Horde CSV import arbitrary PHP code execution
exploit/multi/http/horde_csv_rce
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Debian2 products
- php-horde-data< 2.1.5-1 | < 2.1.0-5+deb8u1
- debian_linuxEOL8.0
Fedoraproject1 product
- fedoraEOL30 | 31
Horde1 product
- groupware5.2.22
Ubuntu1 product
- php-horde-dataAll versions (No fix recorded)
4 vendors · 5 products
References
10 links- lists.horde.org/archives/announce/2020/001285.htmlX Refsource CONFIRMREPORTMailing ListVendor Advisory
- packetstormsecurity.com/files/156872/Horde-5.2.22-CSV-Import-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2020/04/msg00008.htmlMailing ListX Refsource MLISTThird Party Advisory