Every CVESearch/Get API key

CVE-2014-5447

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which...

2.1 Low

CVE-2014-5447 is a low vulnerability (CVSS 2.1) in Zarafa Webapp, published September 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. No source names a fixed version.

What does this mean?
Severity
2.1 LowCVSS 2.0, NVD
Exploit chance
0.37%EPSS, 31st percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.

Exploit likelihood

0.37%Down 0.6 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
zarafa
Mageia:3
From an advisory covering 5 CVEs
before 7.1.11-1.mga3
7.1.11-1.mga3
zarafa
Mageia:4
From an advisory covering 5 CVEs
before 7.1.11-1.mga4
7.1.11-1.mga4

What each source reports

NVD Score used2.1

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.

Record
CVE-2014-5447
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE ListNo score

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.

Record
CVE-2014-5447
Updated
2026-11-02
EUVDEUVD-2014-5334No score

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.

Record
EUVD-2014-5334
Updated
2026-11-03
GitHub AdvisoriesGHSA-327v-7xhm-qrxfNo score

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which...

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.

Record
GHSA-327v-7xhm-qrxf
Weakness
CWE-200
Updated
2026-11-02
OSVMGASA-2014-0380No score

Updated zarafa packages fix multiple vulnerabilities

Updated zarafa packages fix security vulnerabilities:

Robert Scheck reported that Zarafa's WebAccess stored session information, including login credentials, on-disk in PHP session files. This session file would contain a user's username and password to the Zarafa IMAP server (CVE-2014-0103).

Robert Scheck discovered that the Zarafa Collaboration Platform has multiple incorrect default permissions (CVE-2014-5447, CVE-2014-5448, CVE-2014-5449, CVE-2014-5450).

Record
MGASA-2014-0380
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 4 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open