Vulnerability CVE-2016-4048


Published: 2016-12-15

Description:
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be shown at the login screen to notify external users about issues with sharing links. This mechanism can be abused to inject arbitrary text messages. Users may get tricked to follow instructions injected by third parties as part of social engineering attacks.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Open-Xchange App Suite 7.8.1 Information Disclosure
Martin Heiland
23.06.2016

Type:

CWE-Other

Vendor: Open-xchange
Product: Open-xchange appsuite 
Version: 7.8.1;

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://www.securityfocus.com/archive/1/538732/100/0/threaded
http://www.securitytracker.com/id/1036157

Related CVE
CVE-2019-11806
OX App Suite 7.10.1 and earlier has Insecure Permissions.
CVE-2019-11522
OX App Suite 7.10.0 to 7.10.2 allows XSS.
CVE-2019-11521
OX App Suite 7.10.1 allows Content Spoofing.
CVE-2018-10986
OX Guard 2.8.0 has CSRF.
CVE-2019-7159
OX App Suite 7.10.1 and earlier allows Information Exposure.
CVE-2019-7158
OX App Suite 7.10.0 and earlier has Incorrect Access Control.
CVE-2017-13667
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF.
CVE-2017-13668
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).

Copyright 2019, cxsecurity.com

 

Back to Top