PT-2016-5818 · Open Xchange · Open-Xchange Appsuite

Published 2016-12-15 · Updated 2018-10-19 · CVE-2016-4046

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev11

Description An issue allows the API for configuring external mail accounts to be exploited, enabling access to network components within the operator's trust boundary. Users can inject arbitrary hosts and ports into API calls, potentially gathering information about the existence of hosts and services based on response type, content, and latency. This could allow attackers to obtain internal configuration information about an operator's infrastructure, facilitating subsequent attacks.

Recommendations For versions prior to 7.8.1-rev11, update to version 7.8.1-rev11 or later to resolve the issue. As a temporary workaround, consider restricting access to the API for configuring external mail accounts to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2016-4046

Affected Products

Open-Xchange Appsuite

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-4046 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4046 · Vendor Advisory
• http://securitytracker.com/id/1036157 · Note
• http://securityfocus.com/archive/1/538732/100/0/threaded · Note