PT-2015-7543 · Open Xchange · Open-Xchange Ox Guard

Publicado 2015-11-19 · Atualizado 2018-10-09 · CVE-2015-7385

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.0.0-rev11

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the uid field in a PGP public key. This occurs because the input is not properly handled in "Guard PGP Settings."

Recommendations For versions prior to 2.0.0-rev11, update to version 2.0.0-rev11 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Guard PGP Settings" to minimize the risk of exploitation. Avoid using the uid field in PGP public keys until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-7385

Produtos afetados

Open-Xchange Ox Guard

Referências · 5

• http://packetstormsecurity.com/files/134415/Open-Xchange-Guard-2.0-Cross-Site-Scripting.html · Nota
• http://securitytracker.com/id/1034166 · Nota
• http://software.open-xchange.com/products/guard/doc/Release_Notes_for_Patch_Release_2777_2.0.0_2015-09-30.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-7385 · Nota de Segurança
• http://securityfocus.com/archive/1/536923/100/0/threaded · Nota