Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.8

Horde webmail lets attackers delete or purge emails

CVE-2007-6018 · published 18 years ago
Summary

The IMP client, Horde Application Framework, and Horde Groupware Webmail Edition do not check certain web requests. Because of this, a remote attacker could remove any email or permanently erase deleted messages by sending specially crafted requests. Apply the vendor’s security update or patch to fix the request validation.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
horde framework 3.1.5
cpe:2.3:a:horde:framework:3.1.5:*:*:*:*:*:*:*
horde groupware_webmail_edition 1.0.3
cpe:2.3:a:horde:groupware_webmail_edition:1.0.3:*:*:*:*:*:*:*
horde horde 3.1.5
cpe:2.3:a:horde:horde:3.1.5:*:*:*:*:*:*:*
horde imp 4.1.5
cpe:2.3:a:horde:imp:4.1.5:*:*:*:*:*:*:*
Original advisory text
IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbit...
IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.8 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published11 Jan 2008
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2007-6018 · NVD
Track software like this
Free during beta