Secunia

A vulnerability has been identified in Horde possibly allowing malicious people to gain unauthorised access to an account.

The problem is that Horde may reveal the session ID because it is part of the URL. The browser will supply it as part of the "HTTP_REFERER" value when a user clicks a link in an email. A malicious person with access to a web server could use this to gain unauthorised access to the users email account for as long as the session is valid.

This has been reported to affect version 2.2.3 and possibly earlier.

Solution
Update to version 2.2.4:
Further details available in Customer Area

Provided and/or discovered by
pucciolab

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area