CVE-2015-7984: Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5....

Security readout for executives and security teams

This is an old Horde webmail/groupware flaw where an attacker could trick a logged-in administrator’s browser into sending dangerous admin requests. If successful, the attacker could make the application run system commands, SQL queries, or PHP code with the administrator’s privileges. Exposure is most likely in legacy Horde, Horde Groupware, or Horde Groupware Webmail Edition deployments that remain below the fixed 2015 releases, especially where administrators access the application through a browser while logged in. Prioritize remediation for any internet-accessible or administrator-used Horde deployment. The issue is old, but public exploit information and administrator-level impact make unpatched systems a meaningful business risk. Mitigation focus: Upgrade Horde to 5.2.8 or later.; Upgrade Horde Groupware or Webmail Edition to 5.2.11 or later.; Apply Debian DSA-3391 updates where Debian packages are used..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.