NVD

Id
30532  
Name
CVE-2014-2027  
Description
eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressbook/csv_import.php, (3) cal_fields or (4) trans parameter to calendar/csv_import.php, (5) info_fields or (6) trans parameter to csv_import.php in (a) projectmanager/ or (b) infolog/, or (7) processed parameter to preferences/inc/class.uiaclprefs.inc.php.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-03-31  
Modified Date
2015-04-01  
Seq
2014-2027  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
161412 30532 CVE-2014-2027 http://advisories.mageia.org/MGASA-2014-0116.html  View
161413 30532 CVE-2014-2027 [oss-security] 20140219 Re: CVE request: remote code execution in egroupware <= 1.8.005  View
161414 30532 CVE-2014-2027 [oss-security] 20140219 Re: CVE request: remote code execution in egroupware <= 1.8.005  View
161415 30532 CVE-2014-2027 http://sourceforge.net/projects/egroupware/files/eGroupware-1.8/README/download  View
161416 30532 CVE-2014-2027 MDVSA-2015:087  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19133 JVNDB-2014-008008 eGroupware における PHP オブジェクトインジェクション攻撃を実行される脆弱性 eGroupware には、PHP オブジェクトインジェクション攻撃を実行される、任意のファイルを削除される、および任意のコードを実行される脆弱性が存在します。 CVE-2014-2027 69314 CVE-2014-2027 30532 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-008008.html 2014-03-03 2015-04-03 View