Open-Xchange Security Advisory 2014-04-08

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Vulnerability type: Information exposure CWE-200 Vulnerable version: 7.4.2 and earlier Vulnerable component: frontend Fixed version: 7.4.2-rev13, 7.4.1-rev11, 7.2.2-rev20 Report confidence: Confirmed Solution status: Fixed by Vendor Vendor...

Open-Xchange security vulnerabilities

Password is passed via URI during password reset. Crossite scripting...

CVE-2014-2391

The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain...

CVE-2014-2392

The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs...

CVE-2014-2393

Cross-site scripting XSS vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail attachment...

Deserialization of untrusted data

The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs...

Input validation

The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain...

Cross site scripting

Cross-site scripting XSS vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail attachment...

CVE-2014-2391

The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain...

CVE-2014-2393

Open-Xchange AppSuite is affected by CVE-2014-2393, a Drive attachment filename XSS in the composer. Vulnerable in Open-Xchange AppSuite 7.4.1 before rev11 and 7.4.2 before rev13; fixed in 7.4.2-rev13, 7.4.1-rev11, and 7.2.2-rev20 per Open-Xchange advisory. The issue arises from insufficient vali...

CVE-2014-2391

Open-Xchange AppSuite is affected (versions before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13). The password recovery service improperly treats a string tied to a previously used but invalid password, allowing information exposure via GET parameters present in web server ...

CVE-2014-2392

The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs...

CVE-2014-2392

Open-Xchange App Suite is affected by CVE-2014-2392 (E-Mail autoconfiguration) and CVE-2014-2392 describes that a password is transmitted in a GET parameter. Affected versions include 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13. The underlying issue is information exposure...

CVE-2014-2393

Cross-site scripting XSS vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail attachment...

Open-Xchange AppSuite信息泄露漏洞

Bugtraq ID:66694 CVE ID:CVE-2014-2391 Open-Xchange Server是部分开源的项目，主要开发协同软件，例如电子邮件、日历等。 Open-Xchange AppSuite 7.4.2 及更早版本在实现上存在信息泄露漏洞，本地用户可利用此漏洞访问敏感信息。 0 open-xchange OX App Suite 7.4.2 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://www.open-xchange.com/home.html...

Open-Xchange AppSuite Drive组件Email附件文件名存储型跨站脚本漏洞

CVE ID:CVE-2014-2393 OX App Suite是一个集成云环境,可以帮助用户在任何设备上管理他们的电子邮件、任务、日程安排、文档等。 由于应用程序没有正确校验Drive组件中的Email附件的文件名，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 Open-Xchange AppSuite 7.4.2 Open-Xchange AppSuite 7.4.1 OX App Suite 7.4.2-rev13, 7.4.1-rev11, 7.2.2-rev20版本已修复该漏洞，建议用户下载使用：...

Open-Xchange Email自动配置信息泄漏漏洞

Bugtraq ID:66698 CVE ID:CVE-2014-2392 Open-Xchange Server是部分开源的项目，主要开发协同软件，例如电子邮件、日历等。 由于当使用email自动配置时应用程序通过一个GET请求参数传达某些信息，攻击者可以利用漏洞泄漏帐号密码。 0 Open-Xchange Server 7.x Open-Xchange 7.4.2-rev13, 7.4.1-rev11,或7.2.2-rev20版本已修复此漏洞，建议用户下载使用： http://www.open-xchange.com/home.html...

Open-Xchange Security Advisory 2014-02-10

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 30820 Bug ID Vulnerability type: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page Vulnerable version: 7.4.1 and earlier Vulnerable component: backend Fixed version: 7.2.2-rev31, 7.4.0-rev27,...

CVE-2014-2077

Cross-site scripting XSS vulnerability in the frontend in Open-Xchange OX AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at the top bar'...

Cross site scripting

Cross-site scripting XSS vulnerability in the frontend in Open-Xchange OX AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at the top bar'...