PT-2014-6479 · Zarafa · Zarafa

Published 2014-09-22 · Updated 2017-09-08 · CVE-2014-5448

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zarafa version 5.00

Description The issue allows local users to obtain sensitive information by reading the log files due to world-readable permissions for the files in the log directory.

Recommendations For Zarafa version 5.00, consider changing the permissions of the log directory to restrict access and prevent unauthorized reading of log files.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-5448

MGASA-2014-0380

Affected Products

Zarafa

References · 12

• https://lists.fedoraproject.org/pipermail/package-announce/2014-July/136033.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2014:182 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0380.html · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2014-August/137158.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-5448 · Security Note
• http://advisories.mageia.org/MGASA-2014-0380.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95452 · Note
• http://seclists.org/oss-sec/2014/q3/444 · Note
• http://seclists.org/oss-sec/2014/q3/445 · Note
• http://securityfocus.com/bid/69365 · Note
• https://bugs.mageia.org/show_bug.cgi?id=13822 · Note