Description
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
References (6)
Core 6
Core References
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136044.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1073618
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/68247
Third Party Advisory x_refsource_confirm
http://advisories.mageia.org/MGASA-2014-0380.html
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136033.html
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2014:182
Scores
EPSS
0.0038
EPSS Percentile
30.8%
Details
CWE
CWE-310
Status
published
Products (24)
fedoraproject/fedora
19
fedoraproject/fedora
20
zarafa/webapp
< 1.5
zarafa/zarafa
7.0
zarafa/zarafa
7.0.1
zarafa/zarafa
7.0.2
zarafa/zarafa
7.0.3
zarafa/zarafa
7.0.4
zarafa/zarafa
7.0.5
zarafa/zarafa
7.0.6
... and 14 more
Published
Jul 29, 2014
Tracked Since
Feb 18, 2026