Vulnerability CVE-2016-4028


Published: 2016-12-15

Description:
An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the encryption padding. In combination with AES-CBC, this allows attackers to guess the correct padding. Attackers may run brute-forcing attacks on the content of the guest authentication token and discover user credentials. For a practical attack vector, the guest users needs to have logged in, the content of the guest user's "OxReaderID" cookie and the value of the "auth" parameter needs to be known to the attacker.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Open-Xchange App Suite 7.8.1 Information Disclosure
Martin Heiland
23.06.2016

Type:

CWE-255

(Credentials Management)

Vendor: Open-xchange
Product: Ox guard 
Version: 2.4.0;

CVSS2 => (AV:N/AC:M/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://www.securityfocus.com/archive/1/538732/100/0/threaded
http://www.securitytracker.com/id/1036154

Related CVE
CVE-2019-14227
OX App Suite 7.10.1 and 7.10.2 allows XSS.
CVE-2019-14225
OX App Suite 7.10.1 and 7.10.2 allows SSRF.
CVE-2019-11806
OX App Suite 7.10.1 and earlier has Insecure Permissions.
CVE-2019-11522
OX App Suite 7.10.0 to 7.10.2 allows XSS.
CVE-2019-11521
OX App Suite 7.10.1 allows Content Spoofing.
CVE-2018-10986
OX Guard 2.8.0 has CSRF.
CVE-2019-7159
OX App Suite 7.10.1 and earlier allows Information Exposure.
CVE-2019-7158
OX App Suite 7.10.0 and earlier has Incorrect Access Control.

Copyright 2019, cxsecurity.com

 

Back to Top