CVE-2014-2392
published 2014-04-24CVE-2014-2392: The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCPINAN
EPSS
1.08%
60.9th percentile
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| open-xchange | open-xchange_appsuite | <= 7.2.2 | — |
| open-xchange | open-xchange_appsuite | — | — |
| open-xchange | open-xchange_appsuite | — | — |
| open-xchange | open-xchange_appsuite | — | — |
| open-xchange | open-xchange_appsuite | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Open-Xchange AppSuite up to 7.4.2 Browser History information disclosure (ID 103021)
vuldb·2026-05-11·CVSS 4.3
CVE-2014-2392 [MEDIUM] Open-Xchange AppSuite up to 7.4.2 Browser History information disclosure (ID 103021)
A vulnerability classified as problematic has been found in Open-Xchange AppSuite 7.2.0/7.2.1/7.2.2/7.4.1/7.4.2. This affects an unknown part of the component Browser History. The manipulation leads to information disclosure.
This vulnerability is uniquely identified as CVE-2014-2392. The attack is possible to be carried out remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
GHSA-5px9-63j7-5f27: The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7
ghsa_unreviewed·2022-05-17
CVE-2014-2392 [MEDIUM] CWE-200 GHSA-5px9-63j7-5f27: The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
No detection rules found.
No public exploits indexed.
2014-04-24
Published