CVE-2014-2988

EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.

Published: Oct 27, 2014
Updated: Apr 13, 2023
CVE: CVE-2014-2988
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 8.5
AV:N/AC:M/Au:S/C:C/I:C/A:C

CWEs:

CWE-94

Affected Software
References

Software	From	Fixed in
egroupware / egroupware	-	1.6.001.x
egroupware / egroupware	-	1.8006.x

http://advisories.mageia.org/MGASA-2014-0221.html
http://www.mandriva.com/security/advisories?name=MDVSA-2015:087
http://www.securityfocus.com/archive/1/532103/100/0/threaded
https://www.htbridge.com/advisory/HTB23212

Vulnerability Database

289,697

CVE-2014-2988