| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 5.1 | $0-$5k | 0.00 |
Summary
A vulnerability was found in Open-Xchange AppSuite up to 7.4.1. It has been rated as problematic. This affects an unknown part. The manipulation leads to an unknown weakness. This vulnerability is documented as CVE-2014-5237. There is not any exploit available. Upgrading the affected component is advised.
Details
A vulnerability was found in Open-Xchange AppSuite up to 7.4.1 (Groupware Software) and classified as problematic. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is integrity. The summary by CVE is:
Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded image in a Text document, which is not properly handled by the image preview.
The weakness was released 12/01/2014 as not defined posting (Bugtraq). It is possible to read the advisory at securityfocus.com. The identification of this vulnerability is CVE-2014-5237 since 08/13/2014. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.
Upgrading to version 7.4.2 eliminates this vulnerability.
Entries connected to this vulnerability are available at VDB-71286 and VDB-71285. Be aware that VulDB is the high quality source for vulnerability data.
Product
Type
Vendor
Name
Version
License
Website
- Vendor: https://www.open-xchange.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.3VulDB Meta Temp Score: 5.1
VulDB Base Score: 5.3
VulDB Temp Score: 5.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Server-side request forgeryCWE: CWE-918
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
OpenVAS ID: 103021
OpenVAS Name: Open-Xchange (OX) AppSuite Multiple Vulnerabilities -02 Oct15
OpenVAS File: 🔍
OpenVAS Family: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: AppSuite 7.4.2
Timeline
08/13/2014 🔍12/01/2014 🔍
12/01/2014 🔍
03/27/2015 🔍
04/04/2022 🔍
Sources
Vendor: open-xchange.comAdvisory: 128257⛔
Status: Not defined
Confirmation: 🔍
CVE: CVE-2014-5237 (🔍)
GCVE (CVE): GCVE-0-2014-5237
GCVE (VulDB): GCVE-100-73031
See also: 🔍
Entry
Created: 03/27/2015 14:56Updated: 04/04/2022 18:15
Changes: 03/27/2015 14:56 (43), 04/08/2018 12:33 (10), 04/04/2022 18:08 (3), 04/04/2022 18:15 (2)
Complete: 🔍
Cache ID: 216::103
Be aware that VulDB is the high quality source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.