Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-5755 — Path Traversal in Appsuite

CWE-22 — Path Traversal4 documents4 sources

Severity

5.5MEDIUMNVD

EPSS

0.6%

top 30.05%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Open-xchange Appsuite

Timeline

PublishedJun 16

Latest updateMay 14

Description

Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages1 packages

▶NVDopen-xchange/open-xchange_appsuite7.6.3+4

🔴Vulnerability Details

GHSA

GHSA-6g6h-84h4-rg9p: Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7↗2022-05-14

▶

CVEList

CVE-2018-5755: Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7↗2018-06-15

▶

💥Exploits & PoCs

Exploit-DB

OX App Suite 7.8.4 - Multiple Vulnerabilities↗2018-06-12

▶