CVE-2014-2392 — Sensitive Information Exposure in Appsuite

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 54.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Open-xchange Appsuite
Timeline
PublishedApr 24
Latest updateMay 17

Description

The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-5px9-63j7-5f27: The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7↗2022-05-17
â–¶
CVEList
CVE-2014-2392: The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7↗2014-04-17
â–¶

💬Community

1
Bugzilla
CVE-2014-3504 libserf: failure to properly handle a NUL character in the CommonName or SubjectAltNames fields↗2014-08-12
â–¶
CVE-2014-2392 — Sensitive Information Exposure | cvebase