CVE-2004-1385

CVE-2004-1385 is a medium-severity vulnerability in Phpgroupware with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Description

phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which reveals the web server path in an error message.

Frequently asked questions

What is CVE-2004-1385?
phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which reveals the web server path in an error message.
How severe is CVE-2004-1385?
CVE-2004-1385 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2004-1385 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 7% (94th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2004-1385?
CVE-2004-1385 primarily affects Phpgroupware. In total, 11 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2004-1385?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2004-1385 published?
CVE-2004-1385 was published on 2004-12-31 and last updated on 2026-06-16.

References

Affected products (11)

More vulnerabilities in Phpgroupware

All CVEs affecting Phpgroupware →