CVE-2008-1284 Path traversal in n/a

What is CVE-2008-1284?

CVE-2008-1284 is a medium-severity path traversal vulnerability in n/a, published on 11 Mar 2008. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name.

Weakness: CWE-22

Which versions are affected by CVE-2008-1284?

It affects 3 products.

Products include Horde Groupware, Horde Groupware Webmail Edition, Horde Horde.

How do I fix CVE-2008-1284?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2008-1284 being exploited?

There is no known exploitation of CVE-2008-1284 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2008-7218 Other in n/a Critical 10.0
• CVE-2008-7219 Missing authorization in n/a Critical 10.0
• CVE-2019-12095 Cross-site request forgery in n/a High 8.8
• CVE-2017-7413 Command injection in n/a High 8.8
• CVE-2017-15235 Auth bypass in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DSA-1519-1, GHSA-7mw7-mpj3-2hr3.