PT-2013-3851 · Open Xchange · Open-Xchange Server+1

Publicado 2013-09-05 · Atualizado 2013-09-26 · CVE-2013-2582

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite and Server versions prior to 6.22.0 rev15 Open-Xchange AppSuite and Server versions 6.22.1 prior to rev17 Open-Xchange AppSuite and Server versions 7.0.1 prior to rev6 Open-Xchange AppSuite and Server versions 7.0.2 prior to rev7

Description The issue is related to a CRLF injection vulnerability in the redirect servlet. This vulnerability allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitization of whitespace characters.

Recommendations For Open-Xchange AppSuite and Server versions prior to 6.22.0 rev15, update to version 6.22.0 rev15 or later. For Open-Xchange AppSuite and Server versions 6.22.1 prior to rev17, update to version 6.22.1 rev17 or later. For Open-Xchange AppSuite and Server versions 7.0.1 prior to rev6, update to version 7.0.1 rev6 or later. For Open-Xchange AppSuite and Server versions 7.0.2 prior to rev7, update to version 7.0.2 rev7 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2013-2582

Produtos afetados

Open-Xchange Appsuite

Open-Xchange Server

Referências · 3

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2582 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-2582 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2013-04/0183.html · Nota