Description
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
References
- FEDORA-2014-7889 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1073618
- 68247 vdb-entry
- http://advisories.mageia.org/MGASA-2014-0380.html
- FEDORA-2014-7896 vendor-advisory
- MDVSA-2014:182 vendor-advisory