Vulnerabilities > CVE-2001-1258 - Local 'prefs.lang' vulnerability in Horde IMP

047910
CVSS 3.6 - LOW
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
NONE
local
low complexity
horde
nessus
NVD
Published: 2001-07-21
Updated: 2011-03-08

Summary

Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server.

Vulnerable Configurations

Part Description Count
Application
Horde
7

Nessus

NASL familyDebian Local Security Checks
NASL idDEBIAN_DSA-073.NASL
descriptionThe Horde team released version 2.2.6 of IMP (a web-based IMAP mail program) which fixes three security problems. Their release announcement describes them as follows : - A PHPLIB vulnerability allowed an attacker to provide a value for the array element $_PHPLIB[libdir], and thus to get scripts from another server to load and execute. This vulnerability is remotely exploitable. (Horde 1.2.x ships with its own customized version of PHPLIB, which has now been patched to prevent this problem.) - By using tricky encodings of
last seen2020-06-01
modified2020-06-02
plugin id14910
published2004-09-29
reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/14910
titleDebian DSA-073-1 : imp - 3 remote exploits

References