CVE-2014-0600: Infoleak
Published Aug 29, 2014
·Updated
FileUploadServlet in the Administration service in Novell GroupWise 2014 before SP1 allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter, aka ZDI-CAN-2287.
Affected Software
1 affected component
Novell GroupWise=2014
Event History
Aug 29, 2014
CVE Published
09:55 AM
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-0600?
CVE-2014-0600 is classified as a critical vulnerability that allows remote attackers to read or write arbitrary files.
2
How do I fix CVE-2014-0600?
To fix CVE-2014-0600, update to Novell GroupWise 2014 SP1 or later.
3
What type of attack does CVE-2014-0600 facilitate?
CVE-2014-0600 facilitates unauthorized access to files through improper validation of file parameters.
4
Which versions of Novell GroupWise are affected by CVE-2014-0600?
CVE-2014-0600 affects Novell GroupWise versions prior to SP1 released in 2014.
5
Is CVE-2014-0600 a remote attack vulnerability?
Yes, CVE-2014-0600 allows remote attackers to exploit the vulnerability without authentication.