PT-2004-1242 · Phpgroupware · Phpgroupware

Published 2004-02-03 · Updated 2017-10-10 · CVE-2004-0016

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpgroupware version 0.9.14

Description The calendar module in phpgroupware does not properly enforce the save extension feature for holiday files. This allows remote attackers to create and execute PHP files.

Recommendations For phpgroupware version 0.9.14, consider disabling the calendar module until a patch is available to prevent the creation and execution of malicious PHP files.

Fix

Related Identifiers

CVE-2004-0016

DSA-419

Affected Products

Phpgroupware

References · 5

• http://securityfocus.com/bid/9387 · Vendor Advisory
• http://debian.org/security/2004/dsa-419 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0016 · Security Note
• http://osvdb.org/6860 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13489 · Note