// For flags

CVE-2016-5124

Open-Xchange App Suite 7.8.1 Cross Site Scripting

Severity Score

6.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev14. Adding images from external sources to HTML editors by drag&drop can potentially lead to script code execution in the context of the active user. To exploit this, a user needs to be tricked to use an image from a specially crafted website and add it to HTML editor areas of OX App Suite, for example E-Mail Compose or OX Text. This specific attack circumvents typical XSS filters and detection mechanisms since the code is not loaded from an external service but injected locally. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). To exploit this vulnerability, a attacker needs to convince a user to follow specific steps (social-engineering).

Ha sido descubierto un problema en Open-Xchange OX App Suite en versiones anteriores a 7.8.1-rev14. Añadir imágenes de recursos externos a los editores HTML con drag&drop puede potencialmente permitir una ejecución de código script en el contexto de un usuario activo. Para explotar esto, un usuario necesita ser engañado para usar una imagen de un sitio web manipulado especial y añadirla a las áreas de editor HTML de OX App Suite, por ejemplo E-Mail Compose o OX Text. Este ataque específico evita los filtros XSS y los mecanismos de detección típicos, ya que el código no se carga desde un servicio externo sino que se inyecta localmente. El código script malicioso puede ser ejecutado en un contexto de usuario. Esto puede conducir al secuestro de sesión o activar acciones no deseadas a través de la interfaz web (envío de correo, eliminación de datos, etc.). Para explotar esta vulnerabilidad, un atacante necesita convencer a un usuario de seguir pasos específicos (ingeniería social).

Open-Xchange App Suite version 7.8.1 suffers from a cross site scripting vulnerability.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2016-05-30 CVE Reserved
  • 2016-07-13 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Open-xchange
Search vendor "Open-xchange"
 Open-xchange Appsuite
Search vendor "Open-xchange" for product "Open-xchange Appsuite"
 <= 7.8.1
Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version " <= 7.8.1"
rev12
Affected