Open-Xchange Server up to 7.2.0 delivery=view cross site scripting

Summaryinfo

A vulnerability identified as problematic has been detected in Open-Xchange Server 6.22.0/6.22.1/7.0.1/7.0.2/7.2.0. Affected by this issue is some unknown functionality. Performing a manipulation of the argument delivery=view results in cross site scripting. This vulnerability is reported as CVE-2013-5698. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Open-Xchange Server 6.22.0/6.22.1/7.0.1/7.0.2/7.2.0. This affects some unknown functionality. The manipulation of the argument delivery=view with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view action, aka Bug ID 26373, a different vulnerability than CVE-2013-3106.

The weakness was disclosed 09/05/2013 as not defined posting (Bugtraq). The advisory is shared at archives.neohapsis.com. This vulnerability is uniquely identified as CVE-2013-5698 since 09/05/2013. It is possible to initiate the attack remotely. A authentication is required for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading to version 7.2.0 eliminates this vulnerability.

The entry VDB-64854 is pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Open-Xchange

Name

• Server

Version

• 6.22.0
• 6.22.1
• 7.0.1
• 7.0.2
• 7.2.0

License

• open-source

Website

• Vendor: https://www.open-xchange.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion