PT-2016-7144 · Open Xchange · Open-Xchange Ox Guard

Secator · Published 2016-12-15 · Updated 2018-10-19 · CVE-2016-6853

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.2-rev5

Description An issue allows script code and references to external websites to be injected into the names of PGP public keys. When a user requests the key later using a specific URL, the injected script code might be executed, potentially leading to session hijacking or triggering unwanted actions via the web interface, such as sending mail or deleting data. This could also lure users into a phishing scheme, allowing malicious script code to be executed within a user's context.

Recommendations For Open-Xchange OX Guard versions prior to 2.4.2-rev5, update to version 2.4.2-rev5 or later to resolve the issue. As a temporary workaround, consider restricting access to the PGP public key management interface to minimize the risk of exploitation. Avoid using the vulnerable key management functionality until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-6853

Affected Products

Open-Xchange Ox Guard

References · 6

• 🔥 http://packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/40377 · Exploit
• https://osv.dev/vulnerability/CVE-2016-6853 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6853 · Security Note
• http://securityfocus.com/bid/92920 · Note
• http://securityfocus.com/archive/1/539395/100/0/threaded · Note