PT-2016-7142 · Open Xchange · Open-Xchange Ox Guard

Benjamin Daniel Mussler + 1 · Publicado 2016-12-15 · Atualizado 2018-10-19 · CVE-2016-6851

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.2-rev5

Description An issue in Open-Xchange OX Guard allows script code to be provided as a parameter to the OX Guard guest reader web application, enabling cross-site scripting attacks against arbitrary users without prior authentication. This can lead to malicious script code execution within a user's context, potentially resulting in session hijacking or triggering unwanted actions via the web interface, such as sending mail or deleting data, if the user has an active session on the same domain.

Recommendations For Open-Xchange OX Guard versions prior to 2.4.2-rev5, update to version 2.4.2-rev5 or later to resolve the issue. As a temporary workaround, consider restricting access to the OX Guard guest reader web application to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-6851

Produtos afetados

Open-Xchange Ox Guard

Referências · 6

• 🔥 https://exploit-db.com/exploits/40377 · Exploit
• 🔥 http://packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-6851 · Nota de Segurança
• http://securityfocus.com/bid/92920 · Nota
• http://securityfocus.com/archive/1/539395/100/0/threaded · Nota
• https://osv.dev/vulnerability/CVE-2016-6851 · Aviso do Fabricante