What is CVE-2017-7413?

CVE-2017-7413 is a high-severity vulnerability in Horde Groupware, classified under OS Command Injection. CVSS score: 8.8/10. Published 2017-04-04.

How severe is CVE-2017-7413?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Horde Groupware

CVE-2017-7413

In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.

Vulnerability class: Command Injection (OS Command Injection)

Published 2017-04-04 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.392 (98.6th percentile), scored 2026-10-24.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.404 · newest: 0.392 · change: -0.013

Affected products

Horde Groupware

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.html (Mailing List, Vendor Advisory)
lists.debian.org/debian-lts-announce/2018/06/msg00006.html (mailing-list)

Frequently asked questions

What is CVE-2017-7413?: CVE-2017-7413 is a high-severity vulnerability in Horde Groupware, classified under OS Command Injection. CVSS score: 8.8/10. Published 2017-04-04.
How severe is CVE-2017-7413?: High severity. CVSS v3 base score is 8.8 out of 10.