PT-2016-5402 · Open Xchange · Open-Xchange Appsuite

Published 2016-12-15 · Updated 2018-10-19 · CVE-2016-3173

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions prior to 7.8.0-rev27

Description An issue in Open-Xchange OX AppSuite allows the aria-label parameter of tiles at the Portal to be used for script code injection. This occurs when the name of a displayed file, such as an image, is used in the label and contains script code. As a result, malicious script code can be executed within a user's context, potentially leading to session hijacking or unwanted actions like sending mail or deleting data. This can happen if a user actively adds a malicious file to the portal or if an internal attacker modifies a shared file to include a malicious file name. The vulnerability can also be used to persistently execute injected code from a temporary script execution vulnerability.

Recommendations For versions prior to 7.8.0-rev27, update to version 7.8.0-rev27 or later to resolve the issue. As a temporary workaround, consider restricting the ability for users to add files to the portal and monitor shared files for any modifications that could indicate malicious activity. Avoid using potentially malicious file names that could lead to script execution.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-3173

Affected Products

Open-Xchange Appsuite

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-3173 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3173 · Vendor Advisory
• http://packetstormsecurity.com/files/137187/Open-Xchange-OX-AppSuite-7.8.0-XSS-Open-Redirect.html · Note
• http://securityfocus.com/archive/1/538481/100/0/threaded · Note