Vulnerability CVE-2016-4047


Published: 2016-12-15

Description:
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions (.dtd resources) can be placed within .docx and .xslx files. Those resources were requested when parsing certain parts of the generated document. As a result an attacker can track access to a manipulated document. Usage of a document may get tracked and information about internal infrastructure may get exposed.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Open-Xchange App Suite 7.8.1 Information Disclosure
Martin Heiland
23.06.2016

Type:

CWE-611

(Information Exposure Through XML External Entity Reference)

Vendor: Open-xchange
Product: Open-xchange appsuite 
Version: 7.8.1;

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
2.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://www.securityfocus.com/archive/1/538732/100/0/threaded
http://www.securitytracker.com/id/1036157

Related CVE
CVE-2019-7159
OX App Suite 7.10.1 and earlier allows Information Exposure.
CVE-2019-7158
OX App Suite 7.10.0 and earlier has Incorrect Access Control.
CVE-2017-13667
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF.
CVE-2017-13668
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
CVE-2017-5213
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).
CVE-2017-5212
Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control.
CVE-2017-5211
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing.
CVE-2017-5210
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure.

Copyright 2019, cxsecurity.com

 

Back to Top