6.1

CVE-2018-9997

Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page with data-toggle gadgets.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Open-xchange ≫ Open-xchange Appsuite Version <= 7.6.3
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev14
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev15
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev16
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev17
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev18
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev20
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev22
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev23
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev24
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev25
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev26
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev28
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev29
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev30
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev10
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev11
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev12
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev13
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev14
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev15
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev16
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev17
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev18
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev19
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev20
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev21
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev22
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev23
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev24
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev25
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev26
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev27
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev28
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev29
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev30
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev31
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev32
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev33
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev34
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev35
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev36
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev38
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev39
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev40
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev5
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev6
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev8
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev9
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev10
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev11
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev13
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev14
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev15
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev16
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev17
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev18
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev19
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev20
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev21
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev22
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev23
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev24
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev25
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev26
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev27
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev3
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev4
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev5
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev6
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev7
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev8
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.87% 0.766
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://packetstormsecurity.com/files/154127/Open-Xchange-OX-Guard-Cross-Site-Scripting-Signature-Validation.html
http://seclists.org/fulldisclosure/2018/Jul/12
Third Party Advisory
Mailing List
http://www.securitytracker.com/id/1041213
Third Party Advisory
VDB Entry