CVE-2016-2840 — Cross-site Scripting in Appsuite

CWE-79 — Cross-site Scripting21 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.6%
top 29.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Open-xchange Appsuite
Timeline
PublishedDec 15
Latest updateMay 14

Description

An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject script code that gets reflected through the subsequent status page. Malicious script code can be executed within a trusted domain's context. While no OX App Suite specific data can be manipulated, the vulnerability can be exploited without being authenticated and therefore used for social engineering attacks, stealing cookies or redirecting f…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-7pfx-7xwq-x3pm: An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7↗2022-05-14
▶
CVEList
CVE-2016-2840: An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7↗2016-12-15
▶

📋Vendor Advisories

18
Red Hat
chromium-browser: info leak in extensions↗2016-11-09
▶
Red Hat
chromium-browser: various fixes from internal audits↗2016-11-09
▶
Red Hat
chromium-browser: heap corruption in ffmpeg↗2016-11-09
▶
Red Hat
chromium-browser: out of bounds memory access in v8↗2016-11-09
▶
Red Hat
chromium-browser: out of bounds memory access in v8↗2016-11-01
▶
CVE-2016-2840 — Cross-site Scripting in Appsuite | cvebase