CVE-2014-2988

EGroupware < 1.6.001 and < 1.8006 - Authenticated Remote Code Execution via Crafted Callback Values

Title source: llm
STIX 2.1

Description

EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.

References (4)

Core 4
Core References
Third Party Advisory x_refsource_confirm
http://advisories.mageia.org/MGASA-2014-0221.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2015:087
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/532103/100/0/threaded

Scores

EPSS 0.0184
EPSS Percentile 76.3%

Details

CWE
CWE-94
Status published
Products (2)
egroupware/egroupware < 1.6.001
egroupware/egroupware < 1.8006
Published Oct 27, 2014
Tracked Since Feb 18, 2026