CVE-2009-3236 File upload in n/a
Remote attackers with address book write access can overwrite arbitrary files and execute PHP code via crafted form fields in Horde Groupware.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-3236?
CVE-2009-3236 is a medium-severity vulnerability in n/a, published on 17 Sep 2009. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; reuses temporary filenames during the upload process which allows remote attackers, with privileges to write to the address book, to overwrite arbitrary files and execute PHP code via crafted Horde_Form_Type_image form field elements.
Which versions are affected by CVE-2009-3236?
It affects 2 products.
Products include Horde Application Framework, Horde Groupware.
How do I fix CVE-2009-3236?
Upgrade to a fixed version.
Is CVE-2009-3236 being exploited?
There is no known exploitation of CVE-2009-3236 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6fhg-rjcp-rf8f.