PT-2013-5341 · Open Xchange+1 · Open-Xchange Appsuite+1

Tobias · Published 2013-09-05 · Updated 2013-10-08 · CVE-2013-5035

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions HtmlCleaner versions prior to 2.6 Open-Xchange AppSuite version 7.2.2 before rev13

Description The issue is related to multiple race conditions that can be exploited by remote authenticated users. This can happen in opportunistic circumstances by leveraging the lack of thread safety. The exploitation can occur through a rapid series of operations, such as mail-sending or draft-saving. This allows attackers to read the private e-mail of other persons.

Recommendations For HtmlCleaner versions prior to 2.6, update to version 2.6 or later to resolve the issue. For Open-Xchange AppSuite version 7.2.2 before rev13, apply rev13 or later to fix the problem.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2013-5035

Affected Products

Htmlcleaner

Open-Xchange Appsuite

References · 4

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2013-08/0115.html · Exploit
• 🔥 http://sourceforge.net/p/htmlcleaner/bugs/86 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-5035 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5035 · Note