7.8

CVE-2014-5238

XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Open-xchange ≫ Open-xchange Appsuite Version <= 7.4.1
Open-xchange ≫ Open-xchange Appsuite Version 7.4.2 Update revision1
Open-xchange ≫ Open-xchange Appsuite Version 7.4.2 Update revision10
Open-xchange ≫ Open-xchange Appsuite Version 7.4.2 Update revision2
Open-xchange ≫ Open-xchange Appsuite Version 7.4.2 Update revision3
Open-xchange ≫ Open-xchange Appsuite Version 7.4.2 Update revision4
Open-xchange ≫ Open-xchange Appsuite Version 7.4.2 Update revision5
Open-xchange ≫ Open-xchange Appsuite Version 7.4.2 Update revision6
Open-xchange ≫ Open-xchange Appsuite Version 7.4.2 Update revision7
Open-xchange ≫ Open-xchange Appsuite Version 7.4.2 Update revision8
Open-xchange ≫ Open-xchange Appsuite Version 7.4.2 Update revision9
Open-xchange ≫ Open-xchange Appsuite Version 7.6.0 Update revision1
Open-xchange ≫ Open-xchange Appsuite Version 7.6.0 Update revision2
Open-xchange ≫ Open-xchange Appsuite Version 7.6.0 Update revision3
Open-xchange ≫ Open-xchange Appsuite Version 7.6.0 Update revision4
Open-xchange ≫ Open-xchange Appsuite Version 7.6.0 Update revision5
Open-xchange ≫ Open-xchange Appsuite Version 7.6.0 Update revision6
Open-xchange ≫ Open-xchange Appsuite Version 7.6.0 Update revision7
Open-xchange ≫ Open-xchange Appsuite Version 7.6.0 Update revision8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.93% 0.774
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html
Third Party Advisory
VDB Entry
http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf
Vendor Advisory
Release Notes
http://www.securityfocus.com/archive/1/archive/1/533443/100/0/threaded
Third Party Advisory
VDB Entry