CVE-2009-3236

Published: Sep 17, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; reuses temporary filenames during the upload process which allows remote attackers, with privileges to write to the address book, to overwrite arbitrary files and execute PHP code via crafted Horde_Form_Type_image form field elements.

Affected (26)

Products: Horde: Application Framework, Groupware

Horde

2 products

Application Framework

Groupware

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Horde Application Framework	Version 3.2.1
Horde Application Framework	Version 3.2.2
Horde Application Framework	Version 3.2.3
Horde Application Framework	Version 3.2.4
Horde Application Framework	Version 3.2
Horde Application Framework	Version 3.3.1
Horde Application Framework	Version 3.3.2
Horde Application Framework	Version 3.3.3
Horde Application Framework	Version 3.3.4
Horde Application Framework	Version 3.3

Configuration B

16 vulnerable

Vulnerable Software	Affected Versions
Horde Groupware	Version 1.1.1
Horde Groupware	Version 1.1.2
Horde Groupware	Version 1.1.3
Horde Groupware	Version 1.1.4
Horde Groupware	Version 1.1.5
Horde Groupware	Version 1.1
Horde Groupware	Version 1.1 rc1
Horde Groupware	Version 1.1 rc2
Horde Groupware	Version 1.1 rc3
Horde Groupware	Version 1.1 rc4
Horde Groupware	Version 1.2.1
Horde Groupware	Version 1.2.2
Horde Groupware	Version 1.2.3
Horde Groupware	Version 1.2.3 rc1
Horde Groupware	Version 1.2
Horde Groupware	Version 1.2 rc1