Back to CVE Browser

CVE-2014-2988

HIGH

8.5

CVSS Severity Score

EPSS Score0.1010%

EPSS Percentile12.65th

PublishedOct 27, 2014

Last ModifiedMay 6, 2026

Vulnerability Description

EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.

Affected Platforms (CPE)

📦

Egroupware

Egroupware

<= 1.6.001

📦

Egroupware

Egroupware

<= 1.8006

References & Advisories

🔗 http://advisories.mageia.org/MGASA-2014-0221.html

🔗 http://www.mandriva.com/security/advisories?name=MDVSA-2015:087

🔗 http://www.securityfocus.com/archive/1/532103/100/0/threaded

🔗 https://www.htbridge.com/advisory/HTB23212

🔗 http://advisories.mageia.org/MGASA-2014-0221.html

🔗 http://www.mandriva.com/security/advisories?name=MDVSA-2015:087

🔗 http://www.securityfocus.com/archive/1/532103/100/0/threaded

🔗 https://www.htbridge.com/advisory/HTB23212

Related Vulnerabilities

CVE-2007-315510.0

Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack vectors related to ADOdb. NOTE: due to lac...

CVE-2008-204110.0

Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack vectors and "grave" impact when the web ...

CVE-2007-315410.0

Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and o...

CVE-2005-12037.5

Multiple SQL injection vulnerabilities in index.php in eGroupware before 1.0.0.007 allow remote attackers to execute arbitrary SQL...