6.5

CVE-2017-17062

Exploit
The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated users to save arbitrary user attributes by leveraging improper privilege management.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Open-xchange ≫ Open-xchange Appsuite Version <= 7.6.3
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev14
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev15
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev16
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev17
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev18
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev20
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev22
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev23
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev24
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev25
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev26
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev28
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev29
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev30
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev31
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev32
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev33
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev10
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev11
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev12
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev13
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev14
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev15
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev16
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev17
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev18
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev19
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev20
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev21
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev22
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev23
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev24
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev25
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev26
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev27
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev28
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev29
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev30
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev31
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev32
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev33
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev34
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev35
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev36
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev38
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev39
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev40
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev5
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev6
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev8
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev9
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev10
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev11
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev13
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev14
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev15
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev16
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev17
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev18
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev3
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev4
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev5
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev6
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev7
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev8
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.61% 0.886
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html
Third Party Advisory
Exploit
VDB Entry
http://seclists.org/fulldisclosure/2018/Jun/23
Third Party Advisory
Exploit
Mailing List
https://www.exploit-db.com/exploits/44881/
Third Party Advisory
Exploit
VDB Entry