PT-2013-3852 · Open Xchange · Open-Xchange Server+1

Publicado 2013-09-05 · Atualizado 2013-09-26 · CVE-2013-2583

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite and Server versions prior to 6.20.7 rev16 Open-Xchange AppSuite and Server versions 6.22.0 prior to rev15 Open-Xchange AppSuite and Server versions 6.22.1 prior to rev17 Open-Xchange AppSuite and Server versions 7.0.1 prior to rev6 Open-Xchange AppSuite and Server versions 7.0.2 prior to rev7

Description The issue allows remote attackers to inject arbitrary web script or HTML via various means, including a javascript: URL, malformed nested SCRIPT elements, a mail signature, or JavaScript code within an image file.

Recommendations For versions prior to 6.20.7 rev16, update to version 6.20.7 rev16 or later. For versions 6.22.0 prior to rev15, update to version 6.22.0 rev15 or later. For versions 6.22.1 prior to rev17, update to version 6.22.1 rev17 or later. For versions 7.0.1 prior to rev6, update to version 7.0.1 rev6 or later. For versions 7.0.2 prior to rev7, update to version 7.0.2 rev7 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-2583

Produtos afetados

Open-Xchange Appsuite

Open-Xchange Server

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-2583 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2583 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2013-04/0183.html · Nota