CVE catalog
CVE-2017-15235
php-horde-gollem: CVE-2017-15235
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 5.53% · Oct 25, 2026
The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | php-horde-gollem | sid | 3.0.13-5 | fixed |
| Debian | php-horde-gollem | bookworm | 3.0.13-5 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | php-horde-gollem | source | sid | 3.0.12-1 | not yet assigned | Not reported | Not reported |
| Debian | php-horde-gollem | source | bookworm | 3.0.12-1 | not yet assigned | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [php-horde-gollem]Fixed
Details (2)
3.0.13-5· all · bookwormFixed · Fixed:
3.0.12-1dsa · php-horde-gollem · debian · bookworm; dsa · php-horde-gollem · debian · 12
3.0.13-5· all · bookwormFixed · Fixed:
3.0.12-1dsa · php-horde-gollem · debian · bookworm; dsa · php-horde-gollem · debian · 12
Observed: