VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2004· Updated Apr 16, 2026

CVE-2004-1385

CVE-2004-1385

Description

phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which reveals the web server path in an error message.

Affected products

11
  • PhpGroupWare/Phpgroupware11 versions
    cpe:2.3:a:phpgroupware:phpgroupware:0.9.12:*:*:*:*:*:*:*+ 10 more
    • cpe:2.3:a:phpgroupware:phpgroupware:0.9.12:*:*:*:*:*:*:*
    • cpe:2.3:a:phpgroupware:phpgroupware:0.9.13:*:*:*:*:*:*:*
    • cpe:2.3:a:phpgroupware:phpgroupware:0.9.14:*:*:*:*:*:*:*
    • cpe:2.3:a:phpgroupware:phpgroupware:0.9.14.003:*:*:*:*:*:*:*
    • cpe:2.3:a:phpgroupware:phpgroupware:0.9.14.005:*:*:*:*:*:*:*
    • cpe:2.3:a:phpgroupware:phpgroupware:0.9.14.006:*:*:*:*:*:*:*
    • cpe:2.3:a:phpgroupware:phpgroupware:0.9.14.007:*:*:*:*:*:*:*
    • cpe:2.3:a:phpgroupware:phpgroupware:0.9.16.000:*:*:*:*:*:*:*
    • cpe:2.3:a:phpgroupware:phpgroupware:0.9.16.002:*:*:*:*:*:*:*
    • cpe:2.3:a:phpgroupware:phpgroupware:0.9.16.003:*:*:*:*:*:*:*
    • cpe:2.3:a:phpgroupware:phpgroupware:0.9.16_rc1:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.