CVE-2014-5449 Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.
LowCVSS 2.1
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zarafa webaccess | = 4.1 | No fix listed |
| zarafa webapp | All versions | No fix listed |
References
- advisories.mageia.org
- [oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa mailing-list
- [oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa mailing-list
- MDVSA-2014:182 vendor-advisory
- 69369 vdb-entry
- webaccess-webapp-information-disc(95453) vdb-entry