{"id":"CVE-2022-30287","aliases":["DEBIAN-CVE-2022-30287","DLA-3090-1","DLA-3923-1","EUVD-2022-52239","GHSA-fjfv-mw3h-74w5","UBUNTU-CVE-2022-30287"],"status":"published","title":"Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which...","description":"Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.69413,"percentile":0.99366,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352","CWE-470","CWE-502"],"published":"2022-07-28T21:08:21Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"Debian:12","package":"php-horde-turba","fixed_in":["4.2.25-6"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"php-horde-turba","fixed_in":["4.2.23-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"php-horde-turba","fixed_in":["4.2.25-5+deb11u2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"php-horde-turba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.25-6"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"php-horde-turba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.23-1+deb10u1"}]}],"versions":["4.2.23-1"]},{"source":"osv","ecosystem":"Debian:11","package":"php-horde-turba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.25-5+deb11u2"}]}],"versions":["4.2.25-5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php-horde-turba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.8-1","4.2.10-1","4.2.11-1","4.2.12-1","4.2.12-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php-horde-turba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.20-1","4.2.21-1","4.2.21-1ubuntu1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"horde","product":"groupware"}],"references":[{"url":"https://www.horde.org/apps/webmail","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://blog.sonarsource.com/horde-webmail-rce-via-email/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00022.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00014.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30287","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fjfv-mw3h-74w5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30287.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-30287","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-30287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30287","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-30287","description":"Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.","status":"published","published":"2022-07-28T21:08:21Z","modified":"2024-10-19T13:05:46.048Z","updated_at":"2026-11-02T14:34:31.184134Z"}],"euvd":[{"id":"EUVD-2022-52239","description":"Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.","status":"published","published":"2022-07-28T21:08:21Z","modified":"2024-10-19T13:05:46Z","updated_at":"2026-11-03T00:27:32.691525Z"}],"ghsa":[{"id":"GHSA-fjfv-mw3h-74w5","title":"Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which...","description":"Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.","status":"published","published":"2022-07-29T00:00:18Z","modified":"2023-01-29T05:02:04Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:44:59.173471Z"}],"nvd":[{"id":"CVE-2022-30287","description":"Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.","status":"published","published":"2022-07-28T22:15:08.373Z","modified":"2026-06-17T04:43:25.033Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-470","CWE-502"],"updated_at":"2026-11-02T14:07:24.037422Z"}],"osv":[{"id":"DEBIAN-CVE-2022-30287","description":"Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.","status":"published","published":"2022-07-28T22:15:08.373Z","modified":"2026-11-03T08:02:19.754509516Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"UBUNTU-CVE-2022-30287","description":"Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.","status":"published","published":"2022-07-28T22:15:00Z","modified":"2025-10-24T04:53:39Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CVE-2022-30287","description":"Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.","status":"published","published":"2022-07-28T21:08:21Z","modified":"2026-10-28T02:30:48.090011475Z","updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"DLA-3090-1","title":"php-horde-turba - security update","status":"published","published":"2022-08-31T00:00:00Z","modified":"2026-03-09T01:21:07.257184Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3923-1","title":"php-horde-turba - security update","status":"published","published":"2024-10-19T00:00:00Z","modified":"2026-03-09T01:20:03.21091Z","updated_at":"2026-11-02T15:46:12.203458Z"}]}}