CVE-2014-2027 Code injection in n/a
Remote attackers can execute arbitrary code or delete files via PHP object injection in eGroupware CSV import and preference modules.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-2027?
CVE-2014-2027 is a high-severity code injection vulnerability in n/a, published on 31 Mar 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressbook/csv_import.php, (3) cal_fields or (4) trans parameter to calendar/csv_import.php, (5) info_fields or (6) trans parameter to csv_import.php in (a) projectmanager/ or (b) infolog/, or (7) processed parameter to preferences/inc/class.uiaclprefs.inc.php.
Weakness: CWE-94
Which versions are affected by CVE-2014-2027?
It affects 1 product.
Products include Egroupware Egroupware.
How do I fix CVE-2014-2027?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2014-2027 being exploited?
There is no known exploitation of CVE-2014-2027 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2008-2041 Code injection in n/a
- CVE-2007-3154 Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and other packa
- CVE-2007-3155 Other in n/a
- CVE-2026-22243 EGroupware has SQL Injection in Nextmatch Filter Processing
- CVE-2014-2988 Code injection in n/a
Sources
Also known as GHSA-wjvf-c62h-746v, MGASA-2014-0116.