CVE-2014-5448
Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows...
Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.
Exploit likelihood
What each source reports
NVD Score used
Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.
- Record
CVE-2014-5448- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.
- Record
CVE-2014-5448- Updated
- 2026-11-02
EUVDEUVD-2014-5335 No score
Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.
- Record
EUVD-2014-5335- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-63gp-qr86-84fq No score
Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows...
Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.
- Record
GHSA-63gp-qr86-84fq- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVMGASA-2014-0380 No score
Updated zarafa packages fix multiple vulnerabilities
Updated zarafa packages fix security vulnerabilities:
Robert Scheck reported that Zarafa's WebAccess stored session information, including login credentials, on-disk in PHP session files. This session file would contain a user's username and password to the Zarafa IMAP server (CVE-2014-0103).
Robert Scheck discovered that the Zarafa Collaboration Platform has multiple incorrect default permissions (CVE-2014-5447, CVE-2014-5448, CVE-2014-5449, CVE-2014-5450).
- Record
MGASA-2014-0380- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-5448 is a low vulnerability (CVSS 2.1) in Zarafa, published September 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. No source names a fixed version.