Horde Image API vulnerabilities

2 CVEs affecting Horde Image API, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-14650, published 2017-09-21.

More from Horde.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-14650, published 2017-09-21. High severity, CVSS 8.1. EPSS: 4% chance of exploitation in the next 30 days. A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility. It's not exploitable through any Horde…
• CVE-2017-9774, published 2017-06-21. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication.