Horde Groupware Unauthenticated Admin Access

criticalseverity

10CVSS score

8%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

Horde Groupware contains an administrative account with a blank password, which allows remote attackers to gain access.

Impact

An attacker can gain unauthorized access to sensitive administrative functions and potentially compromise the entire system.

Fix

Apply the latest security patches or upgrade to a patched version of Horde Groupware to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/horde/admin/user.php ; GET {{BaseURL}}/admin/user.php
Positive when: contains "<title>Horde :: User Administration</title>" AND status 200

Run it with nuclei: nuclei -id CVE-2005-3344 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2005-3344

info:
  name: Horde Groupware Unauthenticated Admin Access
  author: pikpikcu
  severity: critical
  description: Horde Groupware contains an administrative account with a blank password, which allows remote attackers to gain access.
  impact: |
    An attacker can gain unauthorized access to sensitive administrative functions and potentially compromise the entire system.
  remediation: |
    Apply the latest security patches or upgrade to a patched version of Horde Groupware to fix the vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2005-3344
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3344
    - http://www.debian.org/security/2005/dsa-884
    - http://www.networkscanning.com/Horde-Default-Admin-Password-Vulnerability-VSS_20171.html
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/24576
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
    cvss-score: 10
    cve-id: CVE-2005-3344
    cwe-id: NVD-CWE-Other
    epss-score: 0.07986
    epss-percentile: 0.94803
    cpe: cpe:2.3:a:horde:horde:3.0.4:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: horde
    product: horde
  tags: cve2005,cve,horde,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/horde/admin/user.php"
      - "{{BaseURL}}/admin/user.php"

    headers:
      Content-Type: text/html

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<title>Horde :: User Administration</title>"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from