PT-2010-2180 · Phpgroupware · Phpgroupware

Published 2010-05-18 · Updated 2018-10-10 · CVE-2010-0403

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpGroupWare (phpgw) versions prior to 0.9.16.016

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the app parameter of the about.php file. This is a directory traversal vulnerability.

Recommendations For versions prior to 0.9.16.016, update to version 0.9.16.016 or later to resolve the issue. As a temporary workaround, consider restricting access to the about.php file until a patch is applied. Avoid using the app parameter in the about.php file with untrusted input until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-0403

DSA-2046-1

Affected Products

Phpgroupware

References · 12

• http://vupen.com/english/advisories/2010/1145 · Vendor Advisory
• http://secunia.com/advisories/39731 · Vendor Advisory
• http://secunia.com/advisories/39665 · Vendor Advisory
• http://download.phpgroupware.org · Vendor Advisory
• http://forums.phpgroupware.org/index.php?t=msg&th=98662&start=0&rid=0 · Patch
• http://vupen.com/english/advisories/2010/1146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0403 · Security Note
• http://debian.org/security/2010/dsa-2046 · Vendor Advisory
• http://securityfocus.com/archive/1/511299/100/0/threaded · Note
• http://securityfocus.com/bid/40167 · Note
• http://lists.gnu.org/archive/html/phpgroupware-users/2010-05/msg00004.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58657 · Note