CVE-2017-7413
HighSummary
In Horde_Crypt before 2.7.6, used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary system commands on the server, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update Horde_Crypt to version 2.7.6 or later and review user PGP settings to minimize the risk of command injection.
Other vulnerabilities in Horde_Crypt
Original NVD description (English source)
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.