EGroupWare < 1.0.0.007 Attachment Information Disclosure

High Nessus Network Monitor Plugin ID 2819

Synopsis

The remote email client may attach unrequested attachments to an outgoing email.

Description

The remote host is running eGroupWare, a web-based groupware solution. It is reported that versions prior 1.0.0.007 are prone to an information disclosure vulnerability. Specifically, if a user composes an email with an attachment and then cancels the email, the attachment will be attached and sent with the next outbound email.

Solution

Upgrade to eGroupWare 1.0.0.007 or higher.

See Also

http://www.gulftech.org/?node=research&amp;article_id=00069-04202005

http://sourceforge.net/project/shownotes.php?release_id=320768

Plugin Details

Severity: High

ID: 2819

Family: CGI

Published: 2005/04/13

Modified: 2016/01/15

Dependencies: 1442

Nessus ID: 15719

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSSv3

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:U/RL:O/RC:C

Reference Information

CVE: CVE-2005-1203, CVE-2005-1129, CVE-2005-1202

BID: 11625, 13137, 13212