eGroupWare: Enterprise Collaboration 1.8.004

eGroupWare is a web-based and multi-user groupware suite developed on a custom set of PHP-based APIs.


Product's homepage

Here are some key features of "eGroupWare: Enterprise Collaboration":

· email
· addressbook
· calendar
· infolog (notes, to-do's, phone calls)
· content management
· forum
· bookmarks
· wiki

What's New in This Release: [ read full changelog ]

· The new release fixes 2 serious security problems, many bugs and implements SyncML 1.2

· Nahuel Grisolia from CYBSEC S.A. Security Systems found two security problems in EGroupware...

· one is a serious remote command execution (allowing to run arbitrary command on the web server by simply issuing a HTTP request!).
· the other a reflected cross-site scripting (XSS).
· both require NO valid EGroupware account and work without being logged in!

· Vulnerable are all EGroupware version incl. 1.4.001+.002, 1.6.001+.002 and the commercial EPL versions 9.1+9.2!

· The problem is fixed in EGroupware's SVN (for 1.6 and trunk) and there will be a coordinated release of a new EGroupware version 1.6.003 by
· Stylite GmbH / EGroupware project and publication of the exploits by CYBSEC S.A. on March 9th.

· WE RECOMMEND EVERYONE UPDATES AS SOON AS POSSIBLE!