PT-2006-1175 · Open Xchange · Open-Xchange

Thomas Pollet · Publicado 2006-01-05 · Atualizado 2016-10-18 · CVE-2006-0091

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Open-Xchange versions 0.8.1-6 and earlier

Description: The issue concerns a cross-site scripting (XSS) vulnerability in the webmail component of Open-Xchange, specifically when the "Inline HTML" feature is enabled. This allows remote attackers to inject arbitrary web script or HTML via email attachments that are rendered inline.

Recommendations: For Open-Xchange versions 0.8.1-6 and earlier, consider disabling the "Inline HTML" feature to prevent the rendering of email attachments inline until a fix is available.

Correção

Identificadores relacionados

CVE-2006-0091

Produtos afetados

Open-Xchange

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-0091 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0091 · Nota
• http://securitytracker.com/id?1015431 · Nota
• http://secunia.com/advisories/18285 · Aviso do Fabricante
• http://marc.info/?l=full-disclosure&m=113629092325679&w=2 · Nota
• http://vupen.com/english/advisories/2006/0034 · Nota