PT-2017-9033 · Open Xchange · Open-Xchange Office Web+3

Published 2017-03-29 · Updated 2017-04-04 · CVE-2016-6846

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open-Xchange (OX) AppSuite backend versions prior to 7.6.2-rev59 Open-Xchange (OX) AppSuite backend versions prior to 7.8.0-rev38 Open-Xchange (OX) AppSuite backend versions prior to 7.8.2-rev8 Open-Xchange (OX) AppSuite frontend versions prior to 7.6.2-rev47 Open-Xchange (OX) AppSuite frontend versions prior to 7.8.0-rev30 Open-Xchange (OX) AppSuite frontend versions prior to 7.8.2-rev8 Open-Xchange (OX) Office Web versions prior to 7.6.2-rev16 Open-Xchange (OX) Office Web versions prior to 7.8.0-rev10 Open-Xchange (OX) Office Web versions prior to 7.8.2-rev5 Open-Xchange (OX) Documentconverter-API versions prior to 7.8.2-rev5

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML.

Recommendations For Open-Xchange (OX) AppSuite backend versions prior to 7.6.2-rev59, update to version 7.6.2-rev59 or later. For Open-Xchange (OX) AppSuite backend versions prior to 7.8.0-rev38, update to version 7.8.0-rev38 or later. For Open-Xchange (OX) AppSuite backend versions prior to 7.8.2-rev8, update to version 7.8.2-rev8 or later. For Open-Xchange (OX) AppSuite frontend versions prior to 7.6.2-rev47, update to version 7.6.2-rev47 or later. For Open-Xchange (OX) AppSuite frontend versions prior to 7.8.0-rev30, update to version 7.8.0-rev30 or later. For Open-Xchange (OX) AppSuite frontend versions prior to 7.8.2-rev8, update to version 7.8.2-rev8 or later. For Open-Xchange (OX) Office Web versions prior to 7.6.2-rev16, update to version 7.6.2-rev16 or later. For Open-Xchange (OX) Office Web versions prior to 7.8.0-rev10, update to version 7.8.0-rev10 or later. For Open-Xchange (OX) Office Web versions prior to 7.8.2-rev5, update to version 7.8.2-rev5 or later. For Open-Xchange (OX) Documentconverter-API versions prior to 7.8.2-rev5, update to version 7.8.2-rev5 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-6846

Affected Products

Open-Xchange Appsuite Backend

Open-Xchange Appsuite Frontend

Open-Xchange Documentconverter-Api

Open-Xchange Office Web

References · 6

• https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3518_7.6.2_2016-08-29.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6846 · Vendor Advisory
• https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3522_7.8.2_2016-08-29.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6846 · Security Note
• http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_3520_7.8.0_2016-08-29.pdf · Vendor Advisory
• http://securityfocus.com/bid/93457 · Note