PT-2015-4228 · Open Xchange · Open-Xchange Server+1

Publicado 2015-02-17 · Atualizado 2018-10-09 · CVE-2014-9466

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange (OX) AppSuite and Server versions prior to 7.4.2-rev42 Open-Xchange (OX) AppSuite and Server version 7.6.0 prior to 7.6.0-rev36 Open-Xchange (OX) AppSuite and Server version 7.6.1 prior to 7.6.1-rev14

Description The issue is related to improper handling of directory permissions, allowing remote authenticated users to read files via unspecified vectors. This is related to the folder identifier.

Recommendations For versions prior to 7.4.2-rev42, update to version 7.4.2-rev42 or later. For version 7.6.0 prior to 7.6.0-rev36, update to version 7.6.0-rev36 or later. For version 7.6.1 prior to 7.6.1-rev14, update to version 7.6.1-rev14 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-9466

Produtos afetados

Open-Xchange Appsuite

Open-Xchange Server

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9466 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100867 · Nota
• http://securitytracker.com/id/1031744 · Nota
• http://securityfocus.com/bid/72587 · Nota
• http://packetstormsecurity.com/files/130379/Open-Xchange-Server-6-OX-AppSuite-7.6.1-Exposure.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9466 · Nota de Segurança
• http://securityfocus.com/archive/1/534695/100/0/threaded · Nota