Every CVESearch/Get API key

CVE-2014-0103

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which...

2.1 Low

CVE-2014-0103 is a low vulnerability (CVSS 2.1) in Zarafa Webapp, published July 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. No source names a fixed version.

Severity
2.1 LowCVSS 2.0, NVD
Exploit chance
0.38%EPSS, 32nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Exploit likelihood

0.38%Down 0.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
zarafa
Mageia:3
From an advisory covering 5 CVEs
before 7.1.11-1.mga3
7.1.11-1.mga3
zarafa
Mageia:4
From an advisory covering 5 CVEs
before 7.1.11-1.mga4
7.1.11-1.mga4

What each source reports

NVD Score used2.1

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Record
CVE-2014-0103
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-310
Updated
2026-11-02
CVE ListNo score

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Record
CVE-2014-0103
Updated
2026-11-02
EUVDEUVD-2014-0183No score

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Record
EUVD-2014-0183
Updated
2026-11-03
GitHub AdvisoriesGHSA-w227-7r9m-46hcNo score

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which...

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Record
GHSA-w227-7r9m-46hc
Updated
2026-11-02
OSVMGASA-2014-0380No score

Updated zarafa packages fix multiple vulnerabilities

Updated zarafa packages fix security vulnerabilities:

Robert Scheck reported that Zarafa's WebAccess stored session information, including login credentials, on-disk in PHP session files. This session file would contain a user's username and password to the Zarafa IMAP server (CVE-2014-0103).

Robert Scheck discovered that the Zarafa Collaboration Platform has multiple incorrect default permissions (CVE-2014-5447, CVE-2014-5448, CVE-2014-5449, CVE-2014-5450).

Record
MGASA-2014-0380
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 4 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open