CVE-2013-6365

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

5.3 MediumFix available

CVE-2013-6365 is a medium vulnerability (CVSS 5.3) in Horde Groupware, published November 5, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 64th percentile. Fixed in php-horde 5.1.5+debian0-1.

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

1.07%Unchanged since Feb 4, 2022

What each source reports

NVD Score used 5.3

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Record: CVE-2013-6365
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0: 2.6 LowAV:N/AC:H/Au:N/C:N/I:P/A:N
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Record: CVE-2013-6365
Updated: 2026-11-02

EUVDEUVD-2013-6190 No score

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Record: EUVD-2013-6190
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r97r-vhq5-2j7h 5.3

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Record: GHSA-r97r-vhq5-2j7h
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness: CWE-352
Updated: 2026-11-02

OSV 5.3

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Record: CVE-2013-6365
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-6365 5.3

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Record: DEBIAN-CVE-2013-6365
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-6365 5.3

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Record: UBUNTU-CVE-2013-6365
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`php-horde` Debian:12	before 5.1.5+debian0-1	5.1.5+debian0-1
`php-horde-kronolith` Debian:12	before 4.1.4-1	4.1.4-1
`php-horde` Ubuntu:16.04:LTS	All versions, plus listed versions 5.2.7+debian0-15.2.8+debian0-15.2.9+debian0-15.2.9+debian0-1build1	None known
`php-horde` Ubuntu:18.04:LTS	All versions, plus listed versions 5.2.16+debian0-15.2.17+debian0-1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 4 moreShow less