Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2024-40614
9.8
CRITICALCVSS v3
Published
July 7, 2024
Affected
2 projects
Assigned by
MITRE
Severity scale
010
Description
EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.
EGroupware/egroupware
GitHubWeb based groupware server written in PHP, forum at https://help.egroupware.org/
GitHubWeb based groupware server written in PHP, forum at https://help.egroupware.org/< 23.1.20240624NVD
egroupware/egroupware
PackagistEGroupware extends a classic groupware with an integrated CRM-system, a secure file-server and Collabora Online Office.
PackagistEGroupware extends a classic groupware with an integrated CRM-system, a secure file-server and Collabora Online Office.< 23.1.20240624NVD