What's new in eGroupWare: Enterprise Collaboration 1.6.003
Mar 9, 2010
- The new release fixes 2 serious security problems, many bugs and implements SyncML 1.2
- Nahuel Grisolia from CYBSEC S.A. Security Systems found two security problems in EGroupware...
- one is a serious remote command execution (allowing to run arbitrary command on the web server by simply issuing a HTTP request!).
- the other a reflected cross-site scripting (XSS).
- both require NO valid EGroupware account and work without being logged in!
- Vulnerable are all EGroupware version incl. 1.4.001+.002, 1.6.001+.002 and the commercial EPL versions 9.1+9.2!
- The problem is fixed in EGroupware's SVN (for 1.6 and trunk) and there will be a coordinated release of a new EGroupware version 1.6.003 by
- Stylite GmbH / EGroupware project and publication of the exploits by CYBSEC S.A. on March 9th.
- WE RECOMMEND EVERYONE UPDATES AS SOON AS POSSIBLE!
New in eGroupWare: Enterprise Collaboration 1.6.002 (Jul 21, 2009)
- fixes 3 security problems:
- FCKeditor (remote file upload)
- tracker (XSS problem)
- knowledgebase (SQL injection)
- added HTML Purifier as preventive measure for FCKeditor content
- tons of bugfixes since initial 1.6.001 release
New in eGroupWare: Enterprise Collaboration 1.6 (Nov 25, 2008)
- A complete rewrite of file manager DMS by means of streamwrapper and WebDAV.
- ACL control on directories and files, which allows uploads of big files.
- Multiple mail accounts and many bugfixes.
- Tracker has an escalation matrix for tickets and automatic mail conversion.
- Calendar has improved functions for recurring events.
- Addressbook has appointment-view, custom fields, and distribution lists shown in contact view and list.
- The project manager has improved template functionality.
- A new default theme for 1.6.
- Massive bugfixes for SyncML.
- Many useful extensions and bugfixes in all modules.
New in eGroupWare: Enterprise Collaboration 1.6 RC3 (Oct 22, 2008)
- Complete new implementation of the filemanager DMS by means of streamwrapper and WebDAV, ACL control on directories and files - the new architecture allows now uploading of big files.
- Implementation of new functions like multiple mail accounts and many bug-fixes in the email client.
- Extensive new features for the tracker-application: for example escalation-matrix for tickets and automatic mail-conversion as a ticket.
- Improved calendar functions especially with recurring-events.
- Supplements and adaptations in the addressbook like appointment-view, custom fields, distribution lists shown in the contact directly and in the addressbook list, multiple categorization of contacts in the addressbook list.
- Improvement of the template functionality of the project manager and some bug-fixes.
- Many useful extensions and adaptations as well as bug-fixes in all modules.