Horde Groupware Webmail Edition Unique Token Cross Site Request Forgery Vulnerability

Bugtraq ID:	63533
Class:	Input Validation Error
CVE:	CVE-2013-6365
Remote:	Yes
Local:	No
Published:	Sep 28 2013 12:00AM
Updated:	Mar 19 2015 08:24AM
Credit:	Marcela Benetrix
Vulnerable:	Horde Project Groupware Webmail Edition 5.1.2
Not Vulnerable:

Horde Groupware Webmail Edition Unique Token Cross Site Request Forgery Vulnerability

Horde Groupware Webmail Edition is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

Horde GroupWare Web Mail Edition 5.1.2 is vulnerable; other versions may also be affected.

Horde Groupware Webmail Edition Unique Token Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice a user into visiting a malicious site.

The following example data is available:

• /data/vulnerabilities/exploits/63533.html

Horde Groupware Webmail Edition Unique Token Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Horde Groupware Webmail Edition Unique Token Cross Site Request Forgery Vulnerability

References:

• [#12804] CSRF in changing permissions functionality (Horde)
  
• Horde Groupware Webmail Edition Homepage (Horde Project)