Vulnerability Description
class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-directory files, which allows remote attackers to obtain sensitive information from these files.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpgroupware | Phpgroupware | 0.9.16.000 |
References
- http://www.osvdb.org/7617
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19195
- https://savannah.gnu.org/bugs/?func=detailitem&item_id=8359Exploit
- http://www.osvdb.org/7617
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19195
- https://savannah.gnu.org/bugs/?func=detailitem&item_id=8359Exploit
FAQ
What is CVE-2004-2576?
CVE-2004-2576 is a vulnerability with a CVSS score of 5.0 (MEDIUM). class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-directory files, which allows remote attackers to obtain sensi...
How severe is CVE-2004-2576?
CVE-2004-2576 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2004-2576?
Check the references section above for vendor advisories and patch information. Affected products include: Phpgroupware Phpgroupware.