CVE-2002-2024
CVE-2002-2024 is a medium-severity vulnerability in Horde Imp with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-219.
Key facts
- Severity: Medium (CVSS 3.x base score 5.3)
- CVSS v2: 5.0
- EPSS exploit prediction: 2% (77th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-219
- Affected product: Horde Imp
- Published:
- Last modified:
Description
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap_serv=nonsense which leaks the information in error messages.
Frequently asked questions
- What is CVE-2002-2024?
- Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap_serv=nonsense which leaks the information in error messages.
- How severe is CVE-2002-2024?
- CVE-2002-2024 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2002-2024 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2002-2024?
- CVE-2002-2024 affects Horde Imp. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2002-2024?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2002-2024 published?
- CVE-2002-2024 was published on 2002-12-31 and last updated on 2026-06-16.
References
- http://bugs.horde.org/show_bug.cgi?id=916
- http://www.iss.net/security_center/static/8768.php
- http://www.securityfocus.com/bid/4445
Affected products (1)
- cpe:2.3:a:horde:imp:2.2.7:*:*:*:*:*:*:*
More vulnerabilities in Horde Imp
- CVE-2003-0025 — High (CVSS 7.5): Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database…
- CVE-2002-0181 — High (CVSS 7.5): Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute…
- CVE-2001-1257 — High (CVSS 7.5): Cross-site scripting vulnerability in Horde Internet Messaging Program (IMP) before 2.2.6 and 1.2.6 allows remote…
- CVE-2007-1474 — Medium (CVSS 6.8): Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application…
- CVE-2004-0584 — Medium (CVSS 6.8): Unknown vulnerability in Horde IMP 3.2.3 and earlier, before a "security fix," does not properly validate input, which…
- CVE-2007-6018 — Medium (CVSS 5.8): IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not…
All CVEs affecting Horde Imp →
Other CWE-219 vulnerabilities
- CVE-2024-39776 — High (CVSS 7.5): Avtec Outpost stores sensitive information in an insecure location without proper access controls in place.
- CVE-2024-56159 — Medium (CVSS 5.3): Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to…
- CVE-2023-39467 — Medium (CVSS 5.3): Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability. This vulnerability allows…