Some vulnerabilities have been reported in various Horde products, which can be exploited by malicious people to bypass certain security restrictions.

1) The Horde API does not properly restrict access to users with the correct credentials. No further information is currently available.

This vulnerability is reported in Horde 3.1.5, Mnemo 2.1.1, Nag 2.1.3, Kronolith 2.1.6, Turba 2.1.5, Horde Groupware Webmail Edition 1.0.3, and Horde Groupware 1.0.2. Prior versions may also be affected.

2) The share change functionality does not properly restrict access to users with the correct credentials. No further information is currently available.

This vulnerability is reported in Mnemo 2.1.1, Nag 2.1.3, Kronolith 2.1.6, Horde Groupware Webmail Edition 1.0.3, and Horde Groupware 1.0.2. Prior versions may also be affected.

Solution
Update to Horde 3.1.6, Mnemo 2.1.2, Nag 2.1.4, Kronolith 2.1.7, Turba 2.1.6, Horde Groupware Webmail Edition 1.0.4, and Horde Groupware 1.0.3.

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers