CVE-2007-2720 Group-Office before 2.16-13 does not properly validate user IDs, which allows remote attackers to obtain sensitive information via certain requests for (1) message.php and (2) messages.php in modules/...
MediumCVSS 4.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Group-Office before 2.16-13 does not properly validate user IDs, which allows remote attackers to obtain sensitive information via certain requests for (1) message.php and (2) messages.php in modules/email/. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| group-office groupware | = 2.16.12 | No fix listed |
References
- group-office.svn.sourceforge.net
- 25369 third-party-advisory
- sourceforge.net patch
- 23925 vdb-entry
- ADV-2007-1773 vdb-entry