PT-2018-17129 · Open Xchange · Open-Xchange Appsuite
Michael Reizelman
·
Published
2018-06-15
·
Updated
2019-10-03
·
CVE-2018-5756
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Open-Xchange OX App Suite versions prior to 7.6.3-rev36
Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev39
Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev44
Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev22
Description:
The issue allows remote authenticated users to delete arbitrary tasks by exploiting a flaw in the backend component's folder-to-object association check. This can be done via a delete action to the "api/tasks" endpoint, using the
task id variable.Recommendations:
For versions prior to 7.6.3-rev36, update to version 7.6.3-rev36 or later.
For versions 7.8.x prior to 7.8.2-rev39, update to version 7.8.2-rev39 or later.
For versions 7.8.3 prior to 7.8.3-rev44, update to version 7.8.3-rev44 or later.
For versions 7.8.4 prior to 7.8.4-rev22, update to version 7.8.4-rev22 or later.
Exploit
Fix
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Open-Xchange Appsuite