PT-2021-17741 · Open Xchange · Ox Documents

Published 2021-07-27 · Updated 2022-07-12 · CVE-2021-28095

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: OX Documents versions prior to 7.10.5-rev5

Description: The issue is related to incorrect access control for documents containing XML structures. This is due to the potential for hash collisions, which can occur because of the use of CRC32.

Recommendations: For versions prior to 7.10.5-rev5, update to version 7.10.5-rev5 or later to resolve the issue.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2021-28095

Affected Products

Ox Documents

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-28095 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28095 · Vendor Advisory
• http://seclists.org/fulldisclosure/2021/Jul/37 · Note
• http://packetstormsecurity.com/files/163569/OX-Documents-7.10.5-Improper-Authorization.html · Note
• https://open-xchange.com · Note