CVE-2014-5449: Infoleak

Published Oct 20, 2014

Updated

Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.

Affected Software

2 affected components

Zarafa WebAccess=4.1

Zarafa webapp

Event History

Oct 20, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5449?

CVE-2014-5449 has a medium severity rating due to the potential exposure of sensitive information.

How do I fix CVE-2014-5449?

To fix CVE-2014-5449, restrict the permissions of the tmp directory to ensure that sensitive session data is not world-readable.

What products are affected by CVE-2014-5449?

CVE-2014-5449 affects Zarafa WebAccess 4.1 and the Zarafa WebApp due to insecure file permissions.

Can local users exploit CVE-2014-5449?

Yes, local users can exploit CVE-2014-5449 to read sensitive session data due to world-readable permissions.

Is CVE-2014-5449 still a concern today?

Yes, CVE-2014-5449 remains a concern if vulnerable versions of Zarafa software are still in use without appropriate security measures.