Home page logo
/

bugtraq logo Bugtraq mailing list archives

Open-Xchange Security Advisory 2014-01-17
From: Martin Braun <martin.braun () open-xchange com>
Date: Fri, 17 Jan 2014 12:15:23 +0100 (CET)

Product: Open-Xchange AppSuite
Vendor: Open-Xchange GmbH


Internal reference: 30357 (Bug ID)
Vulnerability type: CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page)
Vulnerable version: 7.4.1 and earlier
Vulnerable component: backend
Fixed version: 7.2.2-rev29, 7.4.0-rev24, 7.4.1-rev11
Report confidence: Confirmed
Solution status: Fixed by Vendor
Vendor notification: 2013-12-17
Solution date: 2013-12-23
Public disclosure: 2014-01-17
CVE reference: CVE-2013-7141
CVSSv2: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N/E:P/RL:U/RC:C/CDP:LM/TD:M/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
Embedding Javascript code with certain "<%" tags can lead to script execution within the users context. This 
vulnerability is exclusive to users using Internet Explorer 9 or lower.

Risk:
Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted 
actions via the web interface (sending mail, deleting data etc.).

Solution:
Users should update to the latest available patch releases. Users should avoid opening E-Mail attachments or files from 
untrusted sources. Users should avoid using outdated versions of Internet Explorer.



Internal reference: 30358 (Bug ID)
Vulnerability type: CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page)
Vulnerable version: 7.4.1 and earlier
Vulnerable component: backend
Fixed version: 7.2.2-rev29, 7.4.0-rev24, 7.4.1-rev11
Report confidence: Confirmed
Solution status: Fixed by Vendor
Vendor notification: 2013-12-17
Solution date: 2013-12-23
Public disclosure: 2014-01-17
CVE reference: CVE-2013-7142
CVSSv2: 5.7 (AV:N/AC:M/Au:N/C:P/I:N/A:N/E:POC/RL:U/RC:C/CDP:LM/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
Embedding Javascript code with certain parameters of oAuth API calls can lead to reflected script execution within the 
users context and a trusted domain.

Risk:
Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted 
actions like sending mail, deleting data etc. Also, the user may be lured to untrusted content while still working 
within the context of a trusted domain.

Solution:
Users should update to the latest available patch releases. Users should avoid opening hyperlinks from untrusted 
sources.



Internal reference: 30359 (Bug ID)
Vulnerability type: CWE-36: Absolute Path Traversal
Vulnerable version: 7.4.1 and earlier
Vulnerable component: backend
Fixed version: 7.2.2-rev29, 7.4.0-rev24, 7.4.1-rev11
Report confidence: Confirmed
Solution status: Fixed by Vendor
Vendor notification: 2013-12-17
Solution date: 2013-12-23
Public disclosure: 2014-01-17
CVE reference: CVE-2013-7140
CVSSv2: 7.4 (AV:N/AC:M/Au:S/C:C/I:N/A:N/E:P/RL:U/RC:C/CDP:MH/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
Using forged requests against the CalDAV interface can be used to reveal file contents stored at the server system. The 
SAX builder used to deserialize posted XML bodies at the WebDAV interface was used with the default values, thus 
potentially vulnerable against XML external entity attacks (XXE). 

Risk:
Content of the requested file is returned to the attacker. This can be used to spy on credentials, configuration or 
other sensitive data stored at the server.

Solution:
Users should update to the latest available patch releases. The CalDAV interface should be disabled until a solution is 
provided.



Internal reference: 30368 (Bug ID)
Vulnerability type: CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page)
Vulnerable version: 7.4.1
Vulnerable component: frontend
Fixed version: 7.4.1-rev7
Report confidence: Confirmed
Solution status: Fixed by Vendor
Vendor notification: 2013-12-18
Solution date: 2013-12-23
Public disclosure: 2014-01-17
CVE reference: CVE-2013-7143
CVSSv2: 5.7 (AV:N/AC:M/Au:N/C:P/I:N/A:N/E:POC/RL:U/RC:C/CDP:LM/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
Embedding Javascript code with the title of a mail filter rule leads to execution of the embedded code. This enables a 
stored cross-site scripting vulnerability that may be used in conjunction with other vulnerabilities or social 
engineering that placed malicious code at the vulnerable location.

Risk:
Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted 
actions like sending mail, deleting data etc.

Solution:
Users should update to the latest available patch releases. Users should not grant other users access to their account.


  By Date           By Thread  

Current thread:
  • Open-Xchange Security Advisory 2014-01-17 Martin Braun (Jan 17)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault