EGroupware vulnerable to ORDER BY clause mishandling
CVE-2024-40614

9.8CRITICAL

Key Information:

Vendor

EGroupware

Status
Egroupware
Vendor
CVE Published:
7 July 2024

What is CVE-2024-40614?

EGroupware is susceptible to a SQL injection vulnerability stemming from improper handling of the ORDER BY clause in its json.php component. This flaw allows authenticated users to exploit the Address Book or InfoLog functionalities, enabling unauthorized data manipulation or exfiltration via crafted requests. The vulnerability is present in versions of EGroupware before 23.1.20240624, highlighting the need for immediate updates to mitigate potential security risks.

References

https://syss.de
https://github.com/EGroupware/egroupware/releases/tag/23....
https://help.egroupware.org/t/egroupware-maintenance-secu...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.