CVE-2013-5936

2013-09-2510:31:29

CWE-200

mitre

web.nvd.nist.gov

cve-2013-5936

open-xchange appsuite

hazelcast

api

security vulnerability

information disclosure

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

5.9

Confidence

Low

EPSS

0.01

Percentile

83.8%

JSON

The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain sensitive information about (1) runtime activity, (2) network configuration, (3) user sessions, (4) the memcache interface, and (5) the REST interface via API calls such as a hazelcast/rest/cluster/ call, a different vulnerability than CVE-2013-5200.

Affected configurations

Nvd

Node

open-xchangeopen-xchange_appsuiteMatch7.0.1

open-xchangeopen-xchange_appsuiteMatch7.0.2

open-xchangeopen-xchange_appsuiteMatch7.2.0

open-xchangeopen-xchange_appsuiteMatch7.2.1

VendorProductVersionCPE
open-xchangeopen-xchange_appsuite7.0.1cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.1:*:*:*:*:*:*:*
open-xchangeopen-xchange_appsuite7.0.2cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.2:*:*:*:*:*:*:*
open-xchangeopen-xchange_appsuite7.2.0cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.0:*:*:*:*:*:*:*
open-xchangeopen-xchange_appsuite7.2.1cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
open-xchange	open-xchange_appsuite	7.0.1	cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.1:::::::*
open-xchange	open-xchange_appsuite	7.0.2	cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.2:::::::*
open-xchange	open-xchange_appsuite	7.2.0	cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.0:::::::*
open-xchange	open-xchange_appsuite	7.2.1	cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.1:::::::*