{"api_version":"1","generated_at":"2026-07-23T21:10:07+00:00","cve":"CVE-2016-6190","urls":{"html":"https://cve.report/CVE-2016-6190","api":"https://cve.report/api/cve/CVE-2016-6190.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-6190","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-6190"},"summary":{"title":"CVE-2016-6190","description":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date & Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.","state":"PUBLISHED","assigner":"mitre","published_at":"2017-02-17 17:59:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d","name":"https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"(fix) improved previous commit for attributes stripping and UID gener… · inverse-inc/sogo@875a4ac · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2016/07/09/3","name":"http://www.openwall.com/lists/oss-security/2016/07/09/3","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","VDB Entry"],"title":"oss-security - Re: CVE request: several SOGo issues (DOS, XSS, information leakage)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://sogo.nu/bugs/view.php?id=3696","name":"https://sogo.nu/bugs/view.php?id=3696","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"0003696: Meta information can be derived from UID/DTSTAMP attributes though \"View the Date & Time\" restricted access - SOGo | BTS","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225","name":"https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"(fix) improved previous commit for attributes stripping and UID gener… · inverse-inc/sogo@717f45f · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6190","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6190","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"6190","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"inverse-inc","cpe5":"sogo","cpe6":"3.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6190","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"inverse-inc","cpe5":"sogo","cpe6":"3.0.0","cpe7":"beta_1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6190","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"inverse-inc","cpe5":"sogo","cpe6":"3.0.0","cpe7":"beta_2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6190","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"inverse-inc","cpe5":"sogo","cpe6":"3.0.0","cpe7":"beta_3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6190","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"inverse-inc","cpe5":"sogo","cpe6":"3.0.0","cpe7":"beta_4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6190","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"inverse-inc","cpe5":"sogo","cpe6":"3.0.0","cpe7":"beta_5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6190","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"inverse-inc","cpe5":"sogo","cpe6":"3.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6190","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"inverse-inc","cpe5":"sogo","cpe6":"3.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6190","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"inverse-inc","cpe5":"sogo","cpe6":"3.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6190","vulnerable":"1","versionEndIncluding":"2.3.11","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"inverse-inc","cpe5":"sogo","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T01:22:20.665Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://sogo.nu/bugs/view.php?id=3696"},{"name":"[oss-security] 20160709 Re: CVE request: several SOGo issues (DOS, XSS, information leakage)","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2016/07/09/3"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-05-25T00:00:00.000Z","descriptions":[{"lang":"en","value":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date & Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-02-17T16:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225"},{"tags":["x_refsource_CONFIRM"],"url":"https://sogo.nu/bugs/view.php?id=3696"},{"name":"[oss-security] 20160709 Re: CVE request: several SOGo issues (DOS, XSS, information leakage)","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2016/07/09/3"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2016-6190","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date & Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d","refsource":"CONFIRM","url":"https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d"},{"name":"https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225","refsource":"CONFIRM","url":"https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225"},{"name":"https://sogo.nu/bugs/view.php?id=3696","refsource":"CONFIRM","url":"https://sogo.nu/bugs/view.php?id=3696"},{"name":"[oss-security] 20160709 Re: CVE request: several SOGo issues (DOS, XSS, information leakage)","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2016/07/09/3"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2016-6190","datePublished":"2017-02-17T17:00:00.000Z","dateReserved":"2016-07-09T00:00:00.000Z","dateUpdated":"2024-08-06T01:22:20.665Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-02-17 17:59:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:inverse-inc:sogo:*:*:*:*:*:*:*:*","versionEndIncluding":"2.3.11","matchCriteriaId":"91F46E93-705A-41F5-BFA3-4FA2ECA662E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:inverse-inc:sogo:3.0.0:*:*:*:*:*:*:*","matchCriteriaId":"8D20DC1B-9B7D-40FA-A8BA-E2EE75CD490B"},{"vulnerable":true,"criteria":"cpe:2.3:a:inverse-inc:sogo:3.0.0:beta_1:*:*:*:*:*:*","matchCriteriaId":"593ACB47-FA85-40FC-AD6E-20624190C5AB"},{"vulnerable":true,"criteria":"cpe:2.3:a:inverse-inc:sogo:3.0.0:beta_2:*:*:*:*:*:*","matchCriteriaId":"F3CBC066-6D19-4172-8198-F813D06F1CD9"},{"vulnerable":true,"criteria":"cpe:2.3:a:inverse-inc:sogo:3.0.0:beta_3:*:*:*:*:*:*","matchCriteriaId":"6B171622-F0CE-4660-8FE8-DEDF69853AFB"},{"vulnerable":true,"criteria":"cpe:2.3:a:inverse-inc:sogo:3.0.0:beta_4:*:*:*:*:*:*","matchCriteriaId":"45411BA4-31FF-4514-A06E-5D8AA467C55C"},{"vulnerable":true,"criteria":"cpe:2.3:a:inverse-inc:sogo:3.0.0:beta_5:*:*:*:*:*:*","matchCriteriaId":"632B5461-9689-49D9-9FA0-548197162FE3"},{"vulnerable":true,"criteria":"cpe:2.3:a:inverse-inc:sogo:3.0.1:*:*:*:*:*:*:*","matchCriteriaId":"C6A83B27-97CD-4760-903D-15252C351359"},{"vulnerable":true,"criteria":"cpe:2.3:a:inverse-inc:sogo:3.0.2:*:*:*:*:*:*:*","matchCriteriaId":"BEDC58CE-65A3-4800-A70E-B96C597528DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:inverse-inc:sogo:3.1.0:*:*:*:*:*:*:*","matchCriteriaId":"727D82DD-4057-4BC9-A986-7BE847E2BF02"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"6190","Ordinal":"1","Title":"CVE-2016-6190","CVE":"CVE-2016-6190","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"6190","Ordinal":"1","NoteData":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date & Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.","Type":"Description","Title":"CVE-2016-6190"},{"CveYear":"2016","CveId":"6190","Ordinal":"2","NoteData":"2017-02-17","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"6190","Ordinal":"3","NoteData":"2017-02-17","Type":"Other","Title":"Modified"}]}}}