$ cve CVE-2015-7984 JSON

CVE-2015-7984 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 4.1% (pctl 90)

Patch early

A public exploit exists.

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php, (2) SQL queries via the sql parameter to admin/sqlshell.php, or (3) PHP code via the php parameter to admin/phpshell.php.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	4.12% — more likely to be exploited than 90% of all CVEs
Weakness	CWE-352
On CISA KEV	no
Public exploit	yes
Published	2015-11-19
Last modified	2026-06-17

Affected (3)

Vendor	Product
debian	debian linux
horde	groupware
horde	horde application framework

Public exploits

Source	Title	Date
exploit-db	Horde Groupware 5.2.10 - Cross-Site Request Forgery	2015-11-19

References

→ the Explorer · watch your stack · NVD