CVE-2013-6242

Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and the publication name were SPLIT from this CVE ID because they affect different sets of versions.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.html	Third Party Advisory VDB Entry
http://seclists.org/bugtraq/2013/Nov/127	Mailing List Third Party Advisory
http://www.securitytracker.com/id/1029394	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/89250	Third Party Advisory VDB Entry
https://forum.open-xchange.com/showthread.php?8115-Open-Xchange-releases-Security-Patch-2013-11-12-for-v7-2-2-v6-22-3-and-v7-4-0-v6	Vendor Advisory
http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.html	Third Party Advisory VDB Entry
http://seclists.org/bugtraq/2013/Nov/127	Mailing List Third Party Advisory
http://www.securitytracker.com/id/1029394	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/89250	Third Party Advisory VDB Entry
https://forum.open-xchange.com/showthread.php?8115-Open-Xchange-releases-Security-Patch-2013-11-12-for-v7-2-2-v6-22-3-and-v7-4-0-v6	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.3:::::::*
	cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.4:::::::*
	cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.2:::::::*
	cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.0:::::::*

History

21 Nov 2024, 01:58

Type	Values Removed	Values Added
References	~~() http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.html - Third Party Advisory, VDB Entry~~	() http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.html - Third Party Advisory, VDB Entry
References	~~() http://seclists.org/bugtraq/2013/Nov/127 - Mailing List, Third Party Advisory~~	() http://seclists.org/bugtraq/2013/Nov/127 - Mailing List, Third Party Advisory
References	~~() http://www.securitytracker.com/id/1029394 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1029394 - Third Party Advisory, VDB Entry
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/89250 - Third Party Advisory, VDB Entry~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/89250 - Third Party Advisory, VDB Entry
References	~~() https://forum.open-xchange.com/showthread.php?8115-Open-Xchange-releases-Security-Patch-2013-11-12-for-v7-2-2-v6-22-3-and-v7-4-0-v6 - Vendor Advisory~~	() https://forum.open-xchange.com/showthread.php?8115-Open-Xchange-releases-Security-Patch-2013-11-12-for-v7-2-2-v6-22-3-and-v7-4-0-v6 - Vendor Advisory

Information

Published : 2020-01-02 19:15

Updated : 2024-11-21 01:58

NVD link : CVE-2013-6242

Mitre link : CVE-2013-6242

CVE.ORG link : CVE-2013-6242

JSON object : View

Products Affected

open-xchange

open-xchange_appsuite

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2013-6242", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2020-01-02T19:15:11.947", "references": [{"url": "http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/bugtraq/2013/Nov/127", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1029394", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89250", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://forum.open-xchange.com/showthread.php?8115-Open-Xchange-releases-Security-Patch-2013-11-12-for-v7-2-2-v6-22-3-and-v7-4-0-v6", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/bugtraq/2013/Nov/127", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1029394", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89250", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://forum.open-xchange.com/showthread.php?8115-Open-Xchange-releases-Security-Patch-2013-11-12-for-v7-2-2-v6-22-3-and-v7-4-0-v6", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and the publication name were SPLIT from this CVE ID because they affect different sets of versions."}, {"lang": "es", "value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en el front-end en Open-Xchange (OX) AppSuite versiones 6.22.3 anteriores a la versi\u00f3n 6.22.3-rev5 y versiones 6.22.4 anteriores a la versi\u00f3n 6.22.4-rev12, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del asunto de un correo electr\u00f3nico. NOTA: las vulnerabilidades relacionadas con el cuerpo del correo electr\u00f3nico y el nombre de la publicaci\u00f3n fueron SEPARADAS de este ID de CVE porque afectan a diferentes conjuntos de versiones."}], "lastModified": "2024-11-21T01:58:54.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35AE7AAF-70B8-4FE4-B116-45C1169C14AE"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CE301DF-C6FD-4689-84D7-A5551980FDB7"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75B04598-67CD-420B-92C9-9A7459295E11"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DAEED7B-C295-42B4-A60B-2EAA596E3D65"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

6.1 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3 /10

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

JSON object

Attach tags to CVE-2013-6242

6.1^/10

4.3^/10

Attach tags to `CVE-2013-6242`