CVE-2014-0103

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which...

2.1 LowFix available

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Exploit likelihood

0.38%Down 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 2.1

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Record: CVE-2014-0103
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-310
Updated: 2026-11-02

CVE List No score

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Record: CVE-2014-0103
Updated: 2026-11-02

EUVDEUVD-2014-0183 No score

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Record: EUVD-2014-0183
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w227-7r9m-46hc No score

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which...

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Record: GHSA-w227-7r9m-46hc
Updated: 2026-11-02

OSVMGASA-2014-0380 No score

Updated zarafa packages fix multiple vulnerabilities

Updated zarafa packages fix security vulnerabilities:

Robert Scheck reported that Zarafa's WebAccess stored session information, including login credentials, on-disk in PHP session files. This session file would contain a user's username and password to the Zarafa IMAP server (CVE-2014-0103).

Robert Scheck discovered that the Zarafa Collaboration Platform has multiple incorrect default permissions (CVE-2014-5447, CVE-2014-5448, CVE-2014-5449, CVE-2014-5450).

Record: MGASA-2014-0380
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`zarafa` Mageia:3	before 7.1.11-1.mga3	7.1.11-1.mga3
`zarafa` Mageia:4	before 7.1.11-1.mga4	7.1.11-1.mga4

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0103 is a low vulnerability (CVSS 2.1) in Zarafa Webapp, published July 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in zarafa 7.1.11-1.mga3.

References

Show 4 moreShow less