Open-Xchange OX AppSuite Backend information disclosure

Summaryinfo

A vulnerability was found in Open-Xchange OX AppSuite up to 7.6.3-rev35/7.8.3-rev38/7.8.3-rev43/7.8.4-rev21. It has been declared as problematic. Impacted is an unknown function of the component Backend. Executing a manipulation can lead to information disclosure. This vulnerability appears as CVE-2018-5751. The attack may be performed from remote. In addition, an exploit is available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Open-Xchange OX AppSuite up to 7.6.3-rev35/7.8.3-rev38/7.8.3-rev43/7.8.4-rev21 (Groupware Software). It has been declared as problematic. This vulnerability affects some unknown processing of the component Backend. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote authenticated users to obtain sensitive information about external guest users via vectors related to the "groups" and "users" APIs.

The bug was discovered 06/08/2018. The weakness was presented 06/16/2018 as EDB-ID 44881 as not defined exploit (Exploit-DB). The advisory is shared for download at exploit-db.com. This vulnerability was named CVE-2018-5751 since 01/17/2018. The exploitation appears to be easy. The attack can be initiated remotely. Required for exploitation is a single authentication. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

After immediately, there has been an exploit disclosed. It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k.

Applying the patch 7.6.3-rev35/7.8.3-rev38/7.8.3-rev43/7.8.4-rev21 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Exploit-DB (44881). See VDB-119597, VDB-119609, VDB-119610 and VDB-119611 for similar entries. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Groupware Software

Vendor

• Open-Xchange

Name

• OX AppSuite

Version

• 7.6.3-rev35
• 7.8.3-rev38
• 7.8.3-rev43
• 7.8.4-rev21

License

• open-source

Website

• Vendor: https://www.open-xchange.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion