CVE-2007-2720: Medium severity Group-Office Group-office Groupware vulnerability

Published May 16, 2007

Updated

Group-Office before 2.16-13 does not properly validate user IDs, which allows remote attackers to obtain sensitive information via certain requests for (1) message.php and (2) messages.php in modules/email/. NOTE: some of these details are obtained from third party information.

Affected Software

1 affected component

Group-Office Group-office Groupware=2.16.12

Remediation

Patch Available

http://sourceforge.net/project/shownotes.php?release_id=498556&group_id=76359

Event History

May 16, 2007

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-2720?

CVE-2007-2720 has a moderate severity rating due to its ability to expose sensitive information.

How do I fix CVE-2007-2720?

To fix CVE-2007-2720, upgrade to Group-Office version 2.16.13 or later which includes proper user ID validation.

What are the consequences of CVE-2007-2720?

Exploitation of CVE-2007-2720 can allow remote attackers to gain access to sensitive information from email modules.

Which versions of Group-Office are affected by CVE-2007-2720?

CVE-2007-2720 affects Group-Office versions prior to 2.16.13.

How can I determine if my installation is vulnerable to CVE-2007-2720?

Check your Group-Office version; if it is 2.16.12 or earlier, it is vulnerable to CVE-2007-2720.