CVE-2020-8518 - Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution

CRITICAL

Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution

Published Feb 17, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 71.73%

Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

Link	Providers	Tags
http://packetstormsecurity.com/files/156872/Horde-5.2.22-CSV-Import-Code-Execution.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://lists.debian.org/debian-lts-announce/2020/04/msg00008.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PRPIFQDGYPQ3F2TF2ETPIL7IYNSVVZQ/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKTNYDBDVJNMVC7QPXQI7CMPLX3USZ2T/		vendor-advisoryx_refsource_FEDORA
https://lists.horde.org/archives/announce/2020/001285.html		x_refsource_CONFIRMMailing ListVendor Advisory

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Feb 17, 2020

Updated Aug 4, 2024

Reserved Feb 3, 2020

Updated n/a

Status Modified

Modified Jun 17, 2026

Severity n/a

Public date n/a