CVE-2014-0103 WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
LowCVSS 2.1
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zarafa webapp | <= 1.5 | No fix listed |
| zarafa | <= 7.1.9 | No fix listed |
| zarafa | = 7.0 | No fix listed |
| zarafa | = 7.0.1 | No fix listed |
| zarafa | = 7.0.2 | No fix listed |
| zarafa | = 7.0.3 | No fix listed |
| zarafa | = 7.0.4 | No fix listed |
| zarafa | = 7.0.5 | No fix listed |
| zarafa | = 7.0.6 | No fix listed |
| zarafa | = 7.0.7 | No fix listed |
| zarafa | = 7.0.8 | No fix listed |
| zarafa | = 7.0.9 | No fix listed |
| zarafa | = 7.0.10 | No fix listed |
| zarafa | = 7.0.11 | No fix listed |
| zarafa | = 7.0.12 | No fix listed |
| zarafa | = 7.0.13 | No fix listed |
| zarafa | = 7.1.0 | No fix listed |
| zarafa | = 7.1.1 | No fix listed |
| zarafa | = 7.1.2 | No fix listed |
| zarafa | = 7.1.3 | No fix listed |
| zarafa | = 7.1.4 | No fix listed |
| zarafa | = 7.1.8 | No fix listed |
| fedoraproject fedora | = 19 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
References
- advisories.mageia.org
- FEDORA-2014-7896 vendor-advisory
- FEDORA-2014-7889 vendor-advisory
- MDVSA-2014:182 vendor-advisory
- 68247 vdb-entry
- bugzilla.redhat.com