Unscored severity · published Oct 2, 2001
CVE-2001-1296
More.groupware PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable
–
CVSS
2.3%
EPSS
No
On KEV
Description
More.groupware PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
More.groupware · Marc Logemann
0.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-1296
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-1296
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2001-10/0012.html
Patch
http://www.iss.net/security_center/static/7215.php
www.moregroupware.org
http://www.moregroupware.org/index.php?action=detail&news_id=24
Vendor Advisory
http://www.securityfocus.com/bid/3383
More from More.groupware
–
CVE-2006-4906
SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbitrary SQL commands via the new_calendarid parameter