CVE-2014-2988
Last modified
CVE-2014-2988 is a vulnerability of currently unknown severity. EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.. EPSS estimates a 1.84% chance of exploitation in the next 30 days.
Description
EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Egroupware | Egroupware | <= 1.6.001 |
| Egroupware | Egroupware | <= 1.8006 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-2988?
How severe is CVE-2014-2988?
How do I fix CVE-2014-2988?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-2978The Dispatch_Write function in proxy/dispatcher/idirectfbsur…
- CVE-2014-2980Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier,…
- CVE-2014-2983Drupal 6.x before 6.31 and 7.x before 7.27 does not properly…
- CVE-2014-2984Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2014-2986The vgic_distr_mmio_write function in the virtual guest inte…
- CVE-2014-2987Multiple cross-site request forgery (CSRF) vulnerabilities i…
- CVE-2014-2989Cross-site request forgery (CSRF) vulnerability in Open Asse…
- CVE-2014-2992The Misli.com application for Android does not verify X.509 …
- CVE-2014-2993The Birebin.com application for Android does not verify X.50…
- CVE-2014-2994Stack-based buffer overflow in Acunetix Web Vulnerability Sc…
- CVE-2014-2995Multiple cross-site scripting (XSS) vulnerabilities in twitg…
- CVE-2014-2996XCloner Standalone 3.5 and earlier, when enable_db_backup an…
Are you affected by CVE-2014-2988?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST