Secunia

Gerald Quakenbush has discovered a security issue in eGroupWare, which may expose sensitive information to malicious people.

The problem is that if a mail with an attachment is composed, but not sent, then the next mail in the same session includes the attachment without this immediately can be seen by the user.

This may potentially cause sensitive information in attachments to be disclosed to other recipients than intended without the user's knowledge.

The security issue has been confirmed in version 1.0.0.006. Other versions may also be affected.

Solution
Check for "hidden" attachments by clicking "Attach File" before sending mails.

Provided and/or discovered by
Gerald Quakenbush

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area