Strix
26.1K

CVE-2004-1385

UnknownEPSS 7.32%

Last modified

CVE-2004-1385 is a vulnerability of currently unknown severity. phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which reveals the web server path in an error message.. EPSS estimates a 7.32% chance of exploitation in the next 30 days.

Description

phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which reveals the web server path in an error message.

Metrics

EPSS Probability
7.32%

93.6th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
PhpgroupwarePhpgroupware0.9.12
PhpgroupwarePhpgroupware0.9.13
PhpgroupwarePhpgroupware0.9.14
PhpgroupwarePhpgroupware0.9.14.003
PhpgroupwarePhpgroupware0.9.14.005
PhpgroupwarePhpgroupware0.9.14.006
PhpgroupwarePhpgroupware0.9.14.007
PhpgroupwarePhpgroupware0.9.16.000
PhpgroupwarePhpgroupware0.9.16.002
PhpgroupwarePhpgroupware0.9.16.003
PhpgroupwarePhpgroupware0.9.16_rc1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2004-1385?
phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which reveals the web server path in an error message.
How severe is CVE-2004-1385?
Severity scoring for CVE-2004-1385 is pending analysis. The EPSS model estimates a 7.32% probability of exploitation in the next 30 days.
How do I fix CVE-2004-1385?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2004-1385?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST