CVE-2014-2393

2014-04-2405:06:05

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-2393

xss

vulnerability

open-xchange appsuite

web script

html

remote attackers

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.9%

JSON

Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail attachment.

Affected configurations

NVD

Node

open-xchangeopen-xchange_appsuiteRange≤7.2.2

open-xchangeopen-xchange_appsuiteMatch7.2.0

open-xchangeopen-xchange_appsuiteMatch7.2.1

open-xchangeopen-xchange_appsuiteMatch7.4.1

open-xchangeopen-xchange_appsuiteMatch7.4.2

CPENameOperatorVersion
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuitele7.2.2
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.2.0
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.2.1
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.4.1
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.4.2

CPE	Name	Operator	Version
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	le	7.2.2
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.2.0
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.2.1
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.4.1
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.4.2