phpgroupware - cross-site scripting and other exploits [LWN.net]

Package(s):

phpgroupware

CVE #(s):

CAN-2003-0504 CAN-2003-0582

Created:

July 16, 2003

Updated:

October 1, 2003

Description:

Several vulnerabilities were discovered in all versions of phpgroupware prior to 0.9.14.006. This latest version fixes an exploitable condition in all versions that can be exploited remotely without authentication and can lead to arbitrary code execution on the web server. This vulnerability is being actively exploited.

Version 0.9.14.005 fixed several other vulnerabilities including cross-site scripting issues that can be exploited to obtain sensitive information such as authentication cookies.

See this Security Corportation report for more information.

CAN-2003-0504
CAN-2003-0582

Alerts:

Debian	DSA-365-1	2003-08-05
Conectiva	CLA-2003:703	2003-07-23
Mandrake	MDKSA-2003:077	2003-07-23
Conectiva	CLA-2003:697	2003-07-16

(Log in to post comments)