CVE-2014-0103

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-29 · updated 2026-06-17
Weakness: CWE-310

Description

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Affected products

Fedoraproject Fedora: 19, 20
Zarafa Webapp: through 1.5
Zarafa: through 7.1.9; 7.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5 (+14)

References

http://advisories.mageia.org/MGASA-2014-0380.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136033.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136044.html
http://www.mandriva.com/security/advisories?name=MDVSA-2014:182
http://www.securityfocus.com/bid/68247
https://bugzilla.redhat.com/show_bug.cgi?id=1073618
http://advisories.mageia.org/MGASA-2014-0380.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136033.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136044.html
http://www.mandriva.com/security/advisories?name=MDVSA-2014:182
http://www.securityfocus.com/bid/68247
https://bugzilla.redhat.com/show_bug.cgi?id=1073618

Get alerted when CVE-2014-0103 or the next vulnerability affects your stack