TI-2014-02388 Aliases CVE-2014-2987 GHSA-2wjg-893f-qh7w

Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line…

LOW 33CWE-352Published 2014-10-26 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Tampering
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator user via an admin.uiaccounts.add_user action to index.php or (2) modify settings via the newsettings parameter in an admin.uiconfig.index action to index.php. NOTE: vector 2 can be used to execute arbitrary PHP code by leveraging CVE-2014-2988.

Why it matters now

EPSS 0.01364 71st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:egroupware:egroupware::::::::	up to 1.6.001	Vulnerable	EGroupware
cpe:2.3:a:egroupware:egroupware:::::community:::*	up to 1.8006	Vulnerable	EGroupware

cpe:2.3:a:egroupware:egroupware:*:*:*:*:*:*:*:* Versions up to 1.6.001 Vulnerable ·EGroupware
cpe:2.3:a:egroupware:egroupware:*:*:*:*:community:*:*:* Versions up to 1.8006 Vulnerable ·EGroupware

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2014-2987
2026-10-03 Alias added: GHSA-2wjg-893f-qh7w

References

Exploit 1

https://www.htbridge.com/advisory/HTB23212

Advisory 2

Other 2

TI-2024-27031 EGroupware before 23.1.20240624 mishandles an ORDER BY clause. CVSS 3.1CRITICAL 9.8
TI-2026-17853 EGroupware has SQL Injection in Nextmatch Filter Processing CVSS 4.0HIGH 8.7
TI-2007-03051 Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as… CVSS 2.0HIGH 10.0
TI-2008-01961 Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack… CVSS 2.0HIGH 10.0
TI-2007-03052 Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack… CVSS 2.0HIGH 10.0
TI-2010-03166 phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchec… CVSS 2.0HIGH 7.5

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences