CVE-2023-38328 Information disclosure in n/a
Authenticated administrators can read cleartext database passwords from the setup panel in eGroupWare.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38328?
CVE-2023-38328 is a medium-severity vulnerability in n/a, published on 26 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in eGroupWare 17.1.20190111. An Improper Password Storage vulnerability affects the setup panel of under setup/manageheader.php, which allows authenticated remote attackers with administrator credentials to read a cleartext database password.
Weakness: CWE-522
Which versions are affected by CVE-2023-38328?
It affects 1 product.
Products include Egroupware Egroupware.
How do I fix CVE-2023-38328?
No fix has been published for CVE-2023-38328 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-38328 being exploited?
There is no known exploitation of CVE-2023-38328 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2008-2041 Code injection in n/a
- CVE-2007-3154 Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and other packa
- CVE-2007-3155 Other in n/a
- CVE-2026-22243 EGroupware has SQL Injection in Nextmatch Filter Processing
- CVE-2014-2988 Code injection in n/a
Sources
Also known as GHSA-jpq4-mchv-jv8r.