CVE-2014-2027

High

Description

eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressbook/csv_import.php, (3) cal_fields or (4) trans parameter to calendar/csv_import.php, (5) info_fields or (6) trans parameter to csv_import.php in (a) projectmanager/ or (b) infolog/, or (7) processed parameter to preferences/inc/class.uiaclprefs.inc.php.

SeverityHigh

CVSS7.5

Exploit probability—

ProductEgroupware

PublishedMar 31, 2015

First seenMar 31, 2015

How to fix

Vendor advisories

security.gentoo.org/glsa/201711-12

Affected products

Product	Affected versions	Fixed in
egroupware egroupware	v ≤ 1.8006	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.