PT-2016-5812 · Open Xchange · Open-Xchange Appsuite

Published 2016-12-15 · Updated 2018-10-19 · CVE-2016-4027

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev10

Description An issue in the App Suite frontend allows cookies with authentication information to be stored even when the user opts not to, specifically when using non-interactive login methods. This can lead to cookies being accessible to other users in shared environments, potentially allowing third parties to access a user's account if the user does not properly log out.

Recommendations For versions prior to 7.8.1-rev10, update to version 7.8.1-rev10 or later to resolve the issue. As a temporary workaround, consider enforcing the cookie setting through middleware configuration or ensuring users log in through the interactive login page. Additionally, users should always properly log out from their sessions to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-4027

Affected Products

Open-Xchange Appsuite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-4027 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4027 · Vendor Advisory
• http://packetstormsecurity.com/files/137599/Open-Xchange-App-Suite-7.8.1-Information-Disclosure.html · Note
• http://securitytracker.com/id/1036157 · Note
• http://securityfocus.com/archive/1/538732/100/0/threaded · Note