PT-2016-5818 · Open Xchange · Open-Xchange Appsuite

Publicado 2016-12-15 · Atualizado 2018-10-19 · CVE-2016-4046

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev11

Description An issue allows the API for configuring external mail accounts to be exploited, enabling access to network components within the operator's trust boundary. Users can inject arbitrary hosts and ports into API calls, potentially gathering information about the existence of hosts and services based on response type, content, and latency. This could allow attackers to obtain internal configuration information about an operator's infrastructure, facilitating subsequent attacks.

Recommendations For versions prior to 7.8.1-rev11, update to version 7.8.1-rev11 or later to resolve the issue. As a temporary workaround, consider restricting access to the API for configuring external mail accounts to minimize the risk of exploitation.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2016-4046

Produtos afetados

Open-Xchange Appsuite

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-4046 · Nota de Segurança
• http://securitytracker.com/id/1036157 · Nota
• http://securityfocus.com/archive/1/538732/100/0/threaded · Nota
• https://osv.dev/vulnerability/CVE-2016-4046 · Aviso do Fabricante