OSVDB ID: 15499 Title: eGroupWare Arbitrary Mail Attachment Disclosure |
Info |
|
|
Dates |
||||
|
|
Description |
eGroupware email contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an email is created with an attachment, then not sent. The attachment will be sent with the next outgoing message regardless of who sends the next mail. |
Classification |
Location:
Local Access Required,
Remote / Network Access
Attack Type: Information Disclosure, Misconfiguration Impact: Loss of Confidentiality Exploit: Exploit Public |
Solution |
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: If you attach a file to a message and then decide not to send it, logout of eGroupWare then log back on before sending any new messages. |
Products |
|
References |
|
Credit |
|