{"id":"CVE-2017-9774","details":"Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication.","modified":"2026-07-08T16:54:39.283464Z","published":"2017-06-21T18:29:00.357Z","references":[{"type":"ADVISORY","url":"https://lists.horde.org/archives/announce/2017/001234.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2018/dsa-4276"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/horde/image","events":[{"introduced":"14f5fefec78a176ccbaa4b08bcb0cdb951ab0155"},{"last_affected":"7f85046c1413be7ebf89b93741e08d21964f4de8"}],"database_specific":{"cpe":["cpe:2.3:a:horde:horde_image_api:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.2:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.4:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.6:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.8:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.0.9:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.3.0:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.3.1:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.3.4:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.3.5:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.3.6:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.4.0:*:*:*:*:*:*:*","cpe:2.3:a:horde:horde_image_api:2.4.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.0.0"},{"last_affected":"2.0.0"},{"introduced":"2.0.0-alpha1"},{"last_affected":"2.0.0-alpha1"},{"introduced":"2.0.0-beta1"},{"last_affected":"2.0.0-beta1"},{"introduced":"2.0.0-beta2"},{"last_affected":"2.0.0-beta2"},{"introduced":"2.0.1"},{"last_affected":"2.0.1"},{"introduced":"2.0.2"},{"last_affected":"2.0.2"},{"introduced":"2.0.3"},{"last_affected":"2.0.3"},{"introduced":"2.0.4"},{"last_affected":"2.0.4"},{"introduced":"2.0.5"},{"last_affected":"2.0.5"},{"introduced":"2.0.6"},{"last_affected":"2.0.6"},{"introduced":"2.0.7"},{"last_affected":"2.0.7"},{"introduced":"2.0.8"},{"last_affected":"2.0.8"},{"introduced":"2.0.9"},{"last_affected":"2.0.9"},{"introduced":"2.1.0"},{"last_affected":"2.1.0"},{"introduced":"2.2.0"},{"last_affected":"2.2.0"},{"introduced":"2.3.0"},{"last_affected":"2.3.0"},{"introduced":"2.3.1"},{"last_affected":"2.3.1"},{"introduced":"2.3.2"},{"last_affected":"2.3.2"},{"introduced":"2.3.3"},{"last_affected":"2.3.3"},{"introduced":"2.3.4"},{"last_affected":"2.3.4"},{"introduced":"2.3.5"},{"last_affected":"2.3.5"},{"introduced":"2.3.6"},{"last_affected":"2.3.6"},{"introduced":"2.4.0"},{"last_affected":"2.4.0"},{"introduced":"2.4.1"},{"last_affected":"2.4.1"}],"source":"CPE_STRING"}}],"versions":["2.0.0","2.0.0-alpha1","2.0.0-beta1","2.0.0-beta2","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.2.0","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.4.0","2.4.1","v2.4.1","v2.4.0","v2.3.6","v2.3.5","v2.3.4","v2.3.3","v2.3.2","v2.3.1","v2.3.0","v2.2.0","v2.1.0","v2.0.9","v2.0.8","v2.0.7","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9774.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}