PT-2015-7543 · Open Xchange · Open-Xchange Ox Guard

Published 2015-11-19 · Updated 2018-10-09 · CVE-2015-7385

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.0.0-rev11

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the uid field in a PGP public key. This occurs because the input is not properly handled in "Guard PGP Settings."

Recommendations For versions prior to 2.0.0-rev11, update to version 2.0.0-rev11 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Guard PGP Settings" to minimize the risk of exploitation. Avoid using the uid field in PGP public keys until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-7385

Affected Products

Open-Xchange Ox Guard

References · 5

• http://software.open-xchange.com/products/guard/doc/Release_Notes_for_Patch_Release_2777_2.0.0_2015-09-30.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7385 · Security Note
• http://packetstormsecurity.com/files/134415/Open-Xchange-Guard-2.0-Cross-Site-Scripting.html · Note
• http://securitytracker.com/id/1034166 · Note
• http://securityfocus.com/archive/1/536923/100/0/threaded · Note