CVE-2025-41066
Disclosure of sensitive information in Horde Groupware
Résumé
Disclosure of sensitive information in Horde Groupware
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the parameters ‘id’ and ‘u’. If the specified user exists, the server will return the download of an empty file; if it does not exist, no download will be initiated, which unequivocally reveals the validity of the user.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-41066 php-horde-groupware
Références
- advisory github.com
- advisory nvd.nist.gov
- web incibe.es