PT-2016-5819 · Open Xchange · Open-Xchange Appsuite

Published 2016-12-15 · Updated 2018-10-19 · CVE-2016-4047

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev8

Description An issue was discovered where references to external Open XML document type definitions (.dtd resources) can be placed within .docx and .xslx files. When parsing certain parts of the generated document, those resources are requested, allowing an attacker to track access to a manipulated document. This could expose information about internal infrastructure.

Recommendations For versions prior to 7.8.1-rev8, update to version 7.8.1-rev8 or later to resolve the issue. As a temporary workaround, consider restricting the use of external .dtd resources in .docx and .xslx files to minimize the risk of exploitation.

Fix

XXE

Information Disclosure

Weakness Enumeration

CWE-611

CWE-200

Related Identifiers

CVE-2016-4047

Affected Products

Open-Xchange Appsuite

References · 4

• https://osv.dev/vulnerability/CVE-2016-4047 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4047 · Security Note
• http://securitytracker.com/id/1036157 · Note
• http://securityfocus.com/archive/1/538732/100/0/threaded · Note