CVE-2017-7414

High

Published: 04/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Horde_Crypt before 2.7.6, used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled and has the preference for automatic verification of PGP signed messages enabled. An attacker can send a maliciously crafted PGP signed email to the Horde user, who must then view or preview it.

Risk Assessment

This vulnerability can lead to unauthorized command execution on the server, posing a serious threat to the organization's data and system security.

Recommendation

It is recommended to update Horde_Crypt to version 2.7.6 or later and to disable the automatic verification of PGP signatures if it is not necessary.

Other vulnerabilities in Horde_Crypt

CVE-2017-7413High
In Horde_Crypt before 2.7.6, used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.

Original NVD description (English source)

In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it.