NVD

Id
31275  
Name
CVE-2014-2988  
Description
EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.  
Reject
 
CVSS Version
2  
CVSS Score
8.5  
Severity
High  
CVSS Base Score
8.5  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2014-10-26  
Modified Date
2015-10-22  
Seq
2014-2988  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
163864 31275 CVE-2014-2988 http://advisories.mageia.org/MGASA-2014-0221.html  View
163865 31275 CVE-2014-2988 MDVSA-2015:087  View
163866 31275 CVE-2014-2988 20140514 CSRF and Remote Code Execution in EGroupware  View
163867 31275 CVE-2014-2988 https://www.htbridge.com/advisory/HTB23212  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16227 JVNDB-2014-005102 複数の EGroupware 製品における任意の PHP コードを実行される脆弱性 EGroupware Enterprise Line (EPL)、EGroupware Community Edition および EGroupware には、任意の PHP コードを実行される脆弱性が存在します。 CVE-2014-2988 70275 CVE-2014-2988 31275 8.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005102.html 2014-05-06 2015-06-23 View