CVE-2025-41066
BaseFortify
Publication date: 2025-12-02
Last updated on: 2025-12-03
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| horde | groupware | 5.2.22 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Horde Groupware v5.2.22 allows an unauthenticated attacker to determine if a user account exists on the system. By sending an HTTP request to '/imp/attachment.php' with specific parameters ('id' and 'u'), the attacker can observe the server's response: if the user exists, the server returns an empty file download; if not, no download occurs. This behavior reveals valid user accounts without authentication.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to enumerate valid user accounts on your Horde Groupware system without authentication. This can facilitate further targeted attacks such as phishing, brute force password attempts, or social engineering, potentially compromising user accounts and system security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending HTTP requests to the '/imp/attachment.php' endpoint with the parameters 'id' and 'u' set to different usernames. If the server responds by initiating a download of an empty file, it indicates that the user exists; if no download occurs, the user does not exist. For example, using curl commands: curl -i 'http://<target>/imp/attachment.php?id=someid&u=validuser' and curl -i 'http://<target>/imp/attachment.php?id=someid&u=invaliduser' to compare responses.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the '/imp/attachment.php' endpoint, implementing authentication to prevent unauthenticated access, and monitoring for suspicious requests targeting this endpoint. Additionally, updating to a patched version of Horde Groupware when available is recommended.