6.5

CVE-2018-9998

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Open-xchange ≫ Open-xchange Appsuite Version <= 7.6.3
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev14
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev15
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev16
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev17
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev18
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev20
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev22
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev23
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev24
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev25
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev26
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev28
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev29
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev30
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev31
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev32
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev33
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev35
Open-xchange ≫ Open-xchange Appsuite Version 7.6.3 Update rev36
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev10
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev11
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev12
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev13
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev14
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev15
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev16
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev17
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev18
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev19
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev20
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev21
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev22
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev23
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev24
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev25
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev26
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev27
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev28
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev29
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev30
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev31
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev32
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev33
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev34
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev35
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev36
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev38
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev39
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev40
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev41
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev42
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev43
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev44
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev45
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev46
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev47
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev5
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev6
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev8
Open-xchange ≫ Open-xchange Appsuite Version 7.8.3 Update rev9
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev10
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev11
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev13
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev14
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev15
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev16
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev17
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev18
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev19
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev20
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev21
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev22
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev23
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev24
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev25
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev26
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev27
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev3
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev4
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev5
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev6
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev7
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev8
Open-xchange ≫ Open-xchange Appsuite Version 7.8.4 Update rev9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.83% 0.761
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://seclists.org/fulldisclosure/2018/Jul/12
Third Party Advisory
Mailing List
http://www.securitytracker.com/id/1041213
Third Party Advisory
VDB Entry