low
2.1
CWE
310
Advisory Published
CVE Published
Updated

CVE-2014-0103

First published: Thu Mar 06 2014(Updated: )

Robert Scheck reported that Zarafa's WebAccess stored session information, including login credentials, on-disk in PHP session files. This session file would contain a user's username and password to the Zarafa IMAP server. If Zarafa WebAccess was run on a shared hosting site (multiple web sites on the same server), and an administrator of another server, with the ability to upload arbitrary scripts to the server, they could use this to obtain these IMAP credentials due to both sites being run by the same Apache user, and the PHP session files being owned by the same. In a non-shared hosting environment, or one using something like SuEXEC, where the PHP session files are owned by individual users on a per-site basis, this would not be an issue. In that case, only a local user able to read these files (either as root or as the user running the Apache web server) would be able to view the credentials.

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
Kopano WebApp<=1.5
Zarafa Collaboration Platform<=7.1.9
Zarafa Collaboration Platform=7.0
Zarafa Collaboration Platform=7.0.1
Zarafa Collaboration Platform=7.0.2
Zarafa Collaboration Platform=7.0.3
Zarafa Collaboration Platform=7.0.4
Zarafa Collaboration Platform=7.0.5
Zarafa Collaboration Platform=7.0.6
Zarafa Collaboration Platform=7.0.7
Zarafa Collaboration Platform=7.0.8
Zarafa Collaboration Platform=7.0.9
Zarafa Collaboration Platform=7.0.10
Zarafa Collaboration Platform=7.0.11
Zarafa Collaboration Platform=7.0.12
Zarafa Collaboration Platform=7.0.13
Zarafa Collaboration Platform=7.1.0
Zarafa Collaboration Platform=7.1.1
Zarafa Collaboration Platform=7.1.2
Zarafa Collaboration Platform=7.1.3
Zarafa Collaboration Platform=7.1.4
Zarafa Collaboration Platform=7.1.8
Fedora=19
Fedora=20

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2014-0103?

    CVE-2014-0103 is considered a medium severity vulnerability due to the exposure of sensitive credentials.

  • How do I fix CVE-2014-0103?

    To fix CVE-2014-0103, ensure that Zarafa WebAccess is upgraded to versions above 1.5 and Zarafa server versions above 7.1.9.

  • What types of information are exposed in CVE-2014-0103?

    CVE-2014-0103 exposes users' login credentials, including usernames and passwords stored in PHP session files.

  • Which versions of Zarafa are affected by CVE-2014-0103?

    CVE-2014-0103 affects Zarafa WebApp versions up to 1.5 and Zarafa server versions up to 7.1.9.

  • Is CVE-2014-0103 a server-side vulnerability?

    Yes, CVE-2014-0103 is a server-side vulnerability that stems from improper session management in Zarafa's WebAccess.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203