PT-2020-7711 · Open Xchange · Open-Xchange Appsuite

Published 2020-01-14 · Updated 2020-01-28 · CVE-2014-5238

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open-Xchange (OX) AppSuite versions prior to 7.4.2-rev11 Open-Xchange (OX) AppSuite versions 7.6.x prior to 7.6.0-rev9

Description The issue allows remote attackers to read arbitrary files and possibly have other unspecified impacts via a crafted OpenDocument Text document. This is due to an XML external entity (XXE) vulnerability.

Recommendations For Open-Xchange (OX) AppSuite versions prior to 7.4.2-rev11, update to version 7.4.2-rev11 or later. For Open-Xchange (OX) AppSuite versions 7.6.x prior to 7.6.0-rev9, update to version 7.6.0-rev9 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2014-5238

Affected Products

Open-Xchange Appsuite

References · 4

• http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-5238 · Security Note
• http://securityfocus.com/archive/1/archive/1/533443/100/0/threaded · Note
• http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html · Note