CVE-2014-5235

2014-09-1714:55:03

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-5235

cross-site scripting

xss

open-xchange

ox appsuite

html injection

nvd

security vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.6%

JSON

Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds.

Affected configurations

NVD

Node

open-xchangeopen-xchange_appsuiteRange≤7.4.1

open-xchangeopen-xchange_appsuiteMatch6.20.7

open-xchangeopen-xchange_appsuiteMatch6.22.0

open-xchangeopen-xchange_appsuiteMatch6.22.1

open-xchangeopen-xchange_appsuiteMatch7.0.1

open-xchangeopen-xchange_appsuiteMatch7.0.2

open-xchangeopen-xchange_appsuiteMatch7.2.0

open-xchangeopen-xchange_appsuiteMatch7.2.1

open-xchangeopen-xchange_appsuiteMatch7.2.2

open-xchangeopen-xchange_appsuiteMatch7.4.0

open-xchangeopen-xchange_appsuiteMatch7.6.0

CPENameOperatorVersion
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuitele7.4.1
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq6.20.7
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq6.22.0
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq6.22.1
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.0.1
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.0.2
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.2.0
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.2.1
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.2.2
open-xchange:open-xchange_appsuiteopen-xchange open-xchange appsuiteeq7.4.0

CPE	Name	Operator	Version
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	le	7.4.1
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	6.20.7
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	6.22.0
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	6.22.1
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.0.1
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.0.2
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.2.0
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.2.1
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.2.2
open-xchange:open-xchange_appsuite	open-xchange open-xchange appsuite	eq	7.4.0