CVE-2013-6241

2014-12-2718:59:00

CWE-200

[email protected]

web.nvd.nist.gov

open-xchange

ox appsuite

sql injection

birthday widget

cve-2013-6241

bug 29315

6.4 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

38.2%

JSON

The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, does not properly construct a SQL statement for next-year birthdays, which allows remote authenticated users to obtain sensitive birthday, displayname, firstname, and surname information via a birthdays action to api/contacts, aka bug 29315.

CPENameOperatorVersion
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.2.2
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.4.0
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.2.0
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.2.1

CPE	Name	Operator	Version
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.2.2
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.4.0
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.2.0
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.2.1