Vulnerability in Zarafa Webapp
CVE-2014-0103
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.004 (30.9th percentile) — read the EPSS interpretation.
Affected products
- Zarafa Webapp
- Zarafa — versions 7.0, 7.0.1, 7.0.2
- Fedoraproject Fedora — versions 19, 20
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA)