Unscored severity · published Jul 21, 2001
CVE-2001-1258
Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file…
–
CVSS
0.5%
EPSS
No
On KEV
Description
Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Imp · Horde
2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-1258
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-1258
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000410
online.securityfocus.com
http://online.securityfocus.com/archive/1/198495
Vendor Advisory
http://www.caldera.com/support/security/advisories/CSSA-2001-027.0.txt
Exploit
http://www.debian.org/security/2001/dsa-073
www.iss.net
http://www.iss.net/security_center/static/6906.php
www.securityfocus.com
http://www.securityfocus.com/bid/3083
More from Imp
7.2
CVE-2025-30349
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror…
6.5
CVE-2026-58451
Horde IMP < 7.0.1 Path Traversal via Compose.php img src
6.1
CVE-2026-65053
Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
5.3
CVE-2002-2024
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4)…
–
CVE-2012-6640
Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to…