CVE-2014-0103: Low severity kopano webapp vulnerability
Robert Scheck reported that Zarafa's WebAccess stored session information, including login credentials, on-disk in PHP session files. This session file would contain a user's username and password to the Zarafa IMAP server.
If Zarafa WebAccess was run on a shared hosting site (multiple web sites on the same server), and an administrator of another server, with the ability to upload arbitrary scripts to the server, they could use this to obtain these IMAP credentials due to both sites being run by the same Apache user, and the PHP session files being owned by the same.
In a non-shared hosting environment, or one using something like SuEXEC, where the PHP session files are owned by individual users on a per-site basis, this would not be an issue. In that case, only a local user able to read these files (either as root or as the user running the Apache web server) would be able to view the credentials.
Other sources
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0103?
CVE-2014-0103 is considered a medium severity vulnerability due to the exposure of sensitive credentials.
How do I fix CVE-2014-0103?
To fix CVE-2014-0103, ensure that Zarafa WebAccess is upgraded to versions above 1.5 and Zarafa server versions above 7.1.9.
What types of information are exposed in CVE-2014-0103?
CVE-2014-0103 exposes users' login credentials, including usernames and passwords stored in PHP session files.
Which versions of Zarafa are affected by CVE-2014-0103?
CVE-2014-0103 affects Zarafa WebApp versions up to 1.5 and Zarafa server versions up to 7.1.9.
Is CVE-2014-0103 a server-side vulnerability?
Yes, CVE-2014-0103 is a server-side vulnerability that stems from improper session management in Zarafa's WebAccess.