CVE-2016-6190 in SOGo
Summary
SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.
Be aware that VulDB is the high quality source for vulnerability data.
Reservation
07/09/2016
Disclosure
02/17/2017
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 97101 | SOGo Appointment information disclosure | 200 | Not defined | Official fix | CVE-2016-6190 |