This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Egroupware First view 2008-04-30
Product Egroupware Last view 2017-09-29
Version 1.4.003 Type Application
Update *  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:egroupware:egroupware

Activity : Overall

Related : CVE

  Date Alert Description
6.1 2017-09-29 CVE-2017-14920

Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the application administrator.

7.5 2015-03-31 CVE-2014-2027

eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressbook/csv_import.php, (3) cal_fields or (4) trans parameter to calendar/csv_import.php, (5) info_fields or (6) trans parameter to csv_import.php in (a) projectmanager/ or (b) infolog/, or (7) processed parameter to preferences/inc/class.uiaclprefs.inc.php.

8.5 2014-10-26 CVE-2014-2988

EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.

6.8 2014-10-26 CVE-2014-2987

Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator user via an admin.uiaccounts.add_user action to index.php or (2) modify settings via the newsettings parameter in an admin.uiconfig.index action to index.php. NOTE: vector 2 can be used to execute arbitrary PHP code by leveraging CVE-2014-2988.

4.3 2012-11-22 CVE-2012-2211

Cross-site scripting (XSS) vulnerability in phpgwapi/inc/common_functions_inc.php in eGroupware before 1.8.004.20120405 allows remote attackers to inject arbitrary web script or HTML via the menuaction parameter to etemplate/process_exec.php. NOTE: some of these details are obtained from third party information.

5.8 2012-08-31 CVE-2011-4951

Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter.

4.3 2012-08-31 CVE-2011-4950

Cross-site scripting (XSS) vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

7.5 2012-08-31 CVE-2011-4949

SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/with_db/loaddetails.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to execute arbitrary SQL commands via the id parameter.

5 2012-08-31 CVE-2011-4948

Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) in the type parameter.

10 2008-04-30 CVE-2008-2041

Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack vectors and "grave" impact when the web server has write access to a directory under the web document root.

CWE : Common Weakness Enumeration

%idName
33% (3) CWE-94 Failure to Control Generation of Code ('Code Injection')
33% (3) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')
11% (1) CWE-352 Cross-Site Request Forgery (CSRF)
11% (1) CWE-89 Improper Sanitization of Special Elements used in an SQL Command ('...
11% (1) CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path ...

Open Source Vulnerability Database (OSVDB)

id Description
44986 eGroupWare Web Server Write Access Unspecified "Grave" Issue

ExploitDB Exploits

id Description
33389 EGroupware 1.8.006 - Multiple Vulnerabilities

OpenVAS Exploits

id Description
2011-06-07 Name : eGroupware Multiple Vulnerabilities
File : nvt/gb_egroupware_mult_vuln.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200805-04 (egroupware)
File : nvt/glsa_200805_04.nasl

Nessus® Vulnerability Scanner

id Description
2017-11-13 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201711-12.nasl - Type: ACT_GATHER_INFO
2015-03-30 Name: The remote Mandriva Linux host is missing one or more security updates.
File: mandriva_MDVSA-2015-087.nasl - Type: ACT_GATHER_INFO
2008-05-09 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-200805-04.nasl - Type: ACT_GATHER_INFO