CVE-2014-2988

Severity: high (CVSS 8.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-10-27 · updated 2026-06-17
Weakness: CWE-94

Description

EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.

Affected products

egroupware: through 1.6.001; through 1.8006

References

http://advisories.mageia.org/MGASA-2014-0221.html
http://www.mandriva.com/security/advisories?name=MDVSA-2015:087
http://www.securityfocus.com/archive/1/532103/100/0/threaded
https://www.htbridge.com/advisory/HTB23212
http://advisories.mageia.org/MGASA-2014-0221.html
http://www.mandriva.com/security/advisories?name=MDVSA-2015:087
http://www.securityfocus.com/archive/1/532103/100/0/threaded
https://www.htbridge.com/advisory/HTB23212

Get alerted when CVE-2014-2988 or the next vulnerability affects your stack