CVE-2007-1474 EXPLOIT
6.8
MEDIUM · CVSS 2.0 · EPSS 4.9% (pctl 92)
Patch early
A public exploit exists.
Description
Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames.
Scoring
| CVSS | 6.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| EPSS | 4.95% — more likely to be exploited than 92% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2007-03-16 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| horde | horde application framework |
| horde | imp |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Horde Framework and IMP 2.x/3.x - Cleanup Cron Script Arbitrary File Deletion | 2007-03-15 |
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489
- http://lists.horde.org/archives/announce/2007/000315.html
- http://secunia.com/advisories/27565
- http://www.debian.org/security/2007/dsa-1406
- http://www.securityfocus.com/bid/22985
- http://www.securitytracker.com/id?1017784
- http://www.securitytracker.com/id?1017785
- http://www.vupen.com/english/advisories/2007/0965
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32997
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489
- http://lists.horde.org/archives/announce/2007/000315.html
- http://secunia.com/advisories/27565
- http://www.debian.org/security/2007/dsa-1406
- http://www.securityfocus.com/bid/22985
- http://www.securitytracker.com/id?1017784
- http://www.securitytracker.com/id?1017785
- http://www.vupen.com/english/advisories/2007/0965
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32997
→ the Explorer · watch your stack · NVD