CVE-2014-5449 Information disclosure in n/a
Local attackers can read sensitive session data from world-readable temporary files in Zarafa WebAccess, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-5449?
CVE-2014-5449 is a low-severity vulnerability in n/a, published on 20 Oct 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.
Weakness: CWE-200
Which versions are affected by CVE-2014-5449?
It affects 2 products.
Products include Zarafa Webaccess, Zarafa Webapp.
How do I fix CVE-2014-5449?
Apply the vendor's patch.
Is CVE-2014-5449 being exploited?
There is no known exploitation of CVE-2014-5449 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jc9x-3ccm-v3m6.