PT-2016-5819 · Open Xchange · Open-Xchange Appsuite

Publicado 2016-12-15 · Atualizado 2018-10-19 · CVE-2016-4047

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev8

Description An issue was discovered where references to external Open XML document type definitions (.dtd resources) can be placed within .docx and .xslx files. When parsing certain parts of the generated document, those resources are requested, allowing an attacker to track access to a manipulated document. This could expose information about internal infrastructure.

Recommendations For versions prior to 7.8.1-rev8, update to version 7.8.1-rev8 or later to resolve the issue. As a temporary workaround, consider restricting the use of external .dtd resources in .docx and .xslx files to minimize the risk of exploitation.

Correção

XXE

Information Disclosure

Enumeração de Fraquezas

CWE-611

CWE-200

Identificadores relacionados

CVE-2016-4047

Produtos afetados

Open-Xchange Appsuite

Referências · 4

• https://osv.dev/vulnerability/CVE-2016-4047 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-4047 · Nota de Segurança
• http://securitytracker.com/id/1036157 · Nota
• http://securityfocus.com/archive/1/538732/100/0/threaded · Nota