PT-2016-7142 · Open Xchange · Open-Xchange Ox Guard

Benjamin Daniel Mussler + 1 · Published 2016-12-15 · Updated 2018-10-19 · CVE-2016-6851

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.2-rev5

Description An issue in Open-Xchange OX Guard allows script code to be provided as a parameter to the OX Guard guest reader web application, enabling cross-site scripting attacks against arbitrary users without prior authentication. This can lead to malicious script code execution within a user's context, potentially resulting in session hijacking or triggering unwanted actions via the web interface, such as sending mail or deleting data, if the user has an active session on the same domain.

Recommendations For Open-Xchange OX Guard versions prior to 2.4.2-rev5, update to version 2.4.2-rev5 or later to resolve the issue. As a temporary workaround, consider restricting access to the OX Guard guest reader web application to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-6851

Affected Products

Open-Xchange Ox Guard

References · 6

• 🔥 https://exploit-db.com/exploits/40377 · Exploit
• 🔥 http://packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-6851 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6851 · Vendor Advisory
• http://securityfocus.com/bid/92920 · Note
• http://securityfocus.com/archive/1/539395/100/0/threaded · Note