Open-Xchange Server And OX App Suite CVE-2013-3106 Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	60283
Class:	Input Validation Error
CVE:	CVE-2013-3106
Remote:	Yes
Local:	No
Published:	Jun 03 2013 12:00AM
Updated:	Jun 03 2013 12:00AM
Credit:	Martin Braun
Vulnerable:
Not Vulnerable:

Open-Xchange Server And OX App Suite CVE-2013-3106 Multiple Cross Site Scripting Vulnerabilities

Open-Xchange Server and OX App Suite are prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected application. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Open-Xchange Server And OX App Suite CVE-2013-3106 Multiple Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.

Open-Xchange Server And OX App Suite CVE-2013-3106 Multiple Cross Site Scripting Vulnerabilities

References:

• Open-Xchange Homepage (Open-Xchange AG)
  
• OX App Suite Homepage (Open-Xchange AG)
  
• Release Notes Public Patch Release 1419 (2013 - 05 - 09 ) (Open-Xchange.Inc)
  
• Release Notes Public Patch Release 1420 (2013 - 0 5 - 09) (Open-Xchange.Inc)
  
• Release Notes Public Patch Release 1421 (2013 - 05 - 0 9 ) (Open-Xchange.Inc)
  
• Release Notes Public Patch Release 1422 (2013 - 0 5 - 09 ) (Open-Xchange.Inc)
  
• Release Notes Public Patch Release 1423 (2013 - 0 5 - 09 ) (Open-Xchange.Inc)
  
• Release Notes Public Patch Release 1424 (2013 - 05 - 0 9 ) (Open-Xchange.Inc)