CVE-2022-30287: debian debian_linux Unsafe Reflection
CVSS: 8.0v3.1HighModified
AliasesUBUNTU-CVE-2022-30287DEBIAN-CVE-2022-30287DLA-3090-1DLA-3923-1
Published 28-07-2022Last modified 19-10-2024
Vulnerability summary
CVE-2022-30287 is a high (CVSS 8.0) Unsafe Reflection vulnerability in debian debian_linux. EPSS estimates a 69.41% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.0/10
010
High · v3.1 (NVD)EPSS score
69.41%
0%100%
Critical · -1.24 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 28-07-2022PublishedVulnerability first disclosed.
- 19-10-2024Last modifiedVulnerability information updated.
Description
Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 8.0Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
69.41%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
-1.24 pp
From 70.65% on 21-09-2026
21-09-202621-10-2026
EPSS score69.41%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.sonarsource.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected systems
Debian2 products
- php-horde-turba< 4.2.23-1+deb10u1 | < 4.2.25-5+deb11u2 | < 4.2.25-6
- debian_linuxEOL10.0
Horde1 product
- groupware≤ 5.2.22
Ubuntu1 product
- php-horde-turbaAll versions (No fix recorded)
3 vendors · 4 products
References
7 links
lists.debian.org/debian-lts-announce/2022/08/msg00022.htmlMailing ListX Refsource MLISTThird Party Advisory