PT-2016-5811 · Open Xchange · Open-Xchange Appsuite

Publicado 2016-12-15 · Atualizado 2018-10-19 · CVE-2016-4026

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev11

Description An issue in the content sanitizer component allows malicious script code to be executed within a user's context when invalid HTML code is provided. This can lead to session hijacking or triggering unwanted actions via the web interface, such as sending mail or deleting data. The issue can be used for filter evasion to inject script code.

Recommendations For versions prior to 7.8.1-rev11, update to version 7.8.1-rev11 or later to resolve the issue. As a temporary workaround, consider restricting the input of invalid HTML code to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-4026

Produtos afetados

Open-Xchange Appsuite

Referências · 4

• https://osv.dev/vulnerability/CVE-2016-4026 · Aviso do Fabricante
• http://securitytracker.com/id/1036157 · Nota
• http://securityfocus.com/archive/1/538732/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4026 · Nota de Segurança