CVE-2015-3436: Medium severity zarafa collaboration platform vulnerability
Published Jun 9, 2015
·Updated
provider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock.
Affected Software
2 affected components
Zarafa Zarafa Collaboration Platform<=7.1.12
Zarafa Zarafa Collaboration Platform=7.2.0
Event History
Jun 9, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-3436?
CVE-2015-3436 is considered to be of medium severity due to its potential for local file manipulation.
2
How do I fix CVE-2015-3436?
To fix CVE-2015-3436, upgrade Zarafa Collaboration Platform to version 7.1.13 or 7.2.1 and above.
3
Who is affected by CVE-2015-3436?
CVE-2015-3436 affects local users of Zarafa Collaboration Platform versions prior to 7.1.13 and 7.2.0.
4
What type of attack does CVE-2015-3436 involve?
CVE-2015-3436 involves a symlink attack that allows local users to write to arbitrary files.
5
When was CVE-2015-3436 reported?
CVE-2015-3436 was reported in June 2015.