Product: Open-Xchange AppSuite
Vendor: Open-Xchange GmbH
Internal reference: 31065
Vulnerability type: Cross Site Scripting (CWE-80)
Vulnerable version: 7.4.1 and 7.4.2
Vulnerable component: frontend
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 7.4.1-rev10, 7.4.2-rev8
Vendor notification: 2014-02-11
Solution date: 2014-02-28
Public disclosure: 2014-03-17
CVE reference: CVE-2014-2077
CVSSv2: 5.7 =
(AV:N/AC:M/Au:N/C:P/I:N/A:N/E:POC/RL:U/RC:C/CDP:LM/TD:H/CR:ND/IR:ND/AR:ND)=
Vulnerability Details:
Script code that gets entered to the subject field of a mail, either by =
direct typing or using reply/forward, gets executed. This is caused by =
"aria" tags for screenreaders at the top bar, which do not use sanitized =
versions of the content. Note that just reading such a mail will not =
trigger the malicious code.
Risk:
Malicious script code can be executed within a users context. This can =
lead to session hijacking or triggering unwanted actions via the web =
interface (sending mail, deleting data etc.).
Solution:
Users should update to the latest patch releases. Users should avoid =
replying or forwarding mails from untrusted sources that contain =
suspicious subjects.
Internal reference: 31185 (Bug ID)
Vulnerability type: Information exposure (CWE-200)
Vulnerable version: 7.4.2
Vulnerable component: backend
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 7.4.2-rev9
Vendor notification: 2014-02-18
Solution date: 2014-02-26
Public disclosure: 2014-03-17
CVE reference: CVE-2014-2078
CVSSv2: 3.9 =
(AV:N/AC:L/Au:M/C:P/I:N/A:N/E:F/RL:U/RC:C/CDP:LM/TD:M/CR:ND/IR:ND/AR:ND)
Vulnerability Details:
Under some circumstances it may happen that E-Mail auto configuration =
for external accounts fails and returns an email address from a =
previously failing configuration attempt from any other user of the =
system.
Risk:
Users may gain unauthorised access to other users data e.g. mail =
addresses. Note that passwords are not affected by this.
Solution:
Users should update to the latest patch releases. As a temporary =
workaround, auto configuration for mail could be disabled at the =
backend:
$ /opt/open-xchange/sbin/stopbundle =
com.openexchange.mail.autoconfig.json=