PT-2016-5812 · Open Xchange · Open-Xchange Appsuite

Publicado 2016-12-15 · Atualizado 2018-10-19 · CVE-2016-4027

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev10

Description An issue in the App Suite frontend allows cookies with authentication information to be stored even when the user opts not to, specifically when using non-interactive login methods. This can lead to cookies being accessible to other users in shared environments, potentially allowing third parties to access a user's account if the user does not properly log out.

Recommendations For versions prior to 7.8.1-rev10, update to version 7.8.1-rev10 or later to resolve the issue. As a temporary workaround, consider enforcing the cookie setting through middleware configuration or ensuring users log in through the interactive login page. Additionally, users should always properly log out from their sessions to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-4027

Produtos afetados

Open-Xchange Appsuite

Referências · 5

• http://packetstormsecurity.com/files/137599/Open-Xchange-App-Suite-7.8.1-Information-Disclosure.html · Nota
• http://securitytracker.com/id/1036157 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4027 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-4027 · Aviso do Fabricante
• http://securityfocus.com/archive/1/538732/100/0/threaded · Nota