Unscored CVE-2014-5447 EUVD-2014-5334GHSA-327v-7xhm-qrxf

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive inform…

Published Oct 20, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Description

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.

References

[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa mailing-list
69362 vdb-entry
http://advisories.mageia.org/MGASA-2014-0380.html
MDVSA-2014:182 vendor-advisory
[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa mailing-list