CVE-2013-6364

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

8.8 HighPublic exploitFix available

CVE-2013-6364 is a high vulnerability (CVSS 8.8) in Horde Groupware, published November 5, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.08%, the 81st percentile. Fixed in php-horde-turba 4.1.3-1.

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.08%Down 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 8.8

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Record: CVE-2013-6364
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-79, CWE-352
Updated: 2026-11-02

CVE List No score

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Record: CVE-2013-6364
Updated: 2026-11-02

EUVDEUVD-2013-6189 No score

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Record: EUVD-2013-6189
Updated: 2026-11-03

GitHub AdvisoriesGHSA-m8j4-9m2h-p788 No score

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Record: GHSA-m8j4-9m2h-p788
Updated: 2026-11-02

OSV 8.8

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Record: CVE-2013-6364
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-6364 8.8

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Record: DEBIAN-CVE-2013-6364
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-6364 8.8

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Record: UBUNTU-CVE-2013-6364
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`php-horde-turba` Debian:12	before 4.1.3-1	4.1.3-1
`php-horde` Ubuntu:16.04:LTS	All versions, plus listed versions 5.2.7+debian0-15.2.8+debian0-15.2.9+debian0-15.2.9+debian0-1build1	None known
`php-horde` Ubuntu:18.04:LTS	All versions, plus listed versions 5.2.16+debian0-15.2.17+debian0-1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Horde Groupware Web Mail Edition 5.1.2 - Cross-Site Request Forgery (2)	2013-11-08

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 4 moreShow less