PT-2016-7144 · Open Xchange · Open-Xchange Ox Guard

Secator · Publicado 2016-12-15 · Atualizado 2018-10-19 · CVE-2016-6853

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.2-rev5

Description An issue allows script code and references to external websites to be injected into the names of PGP public keys. When a user requests the key later using a specific URL, the injected script code might be executed, potentially leading to session hijacking or triggering unwanted actions via the web interface, such as sending mail or deleting data. This could also lure users into a phishing scheme, allowing malicious script code to be executed within a user's context.

Recommendations For Open-Xchange OX Guard versions prior to 2.4.2-rev5, update to version 2.4.2-rev5 or later to resolve the issue. As a temporary workaround, consider restricting access to the PGP public key management interface to minimize the risk of exploitation. Avoid using the vulnerable key management functionality until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-6853

Produtos afetados

Open-Xchange Ox Guard

Referências · 6

• 🔥 http://packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/40377 · Exploit
• https://osv.dev/vulnerability/CVE-2016-6853 · Aviso do Fabricante
• http://securityfocus.com/bid/92920 · Nota
• http://securityfocus.com/archive/1/539395/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6853 · Nota de Segurança