Open-Xchange AppSuite CVE-2013-6242 Multiple HTML Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	63927
Class:	Input Validation Error
CVE:	CVE-2013-6242
Remote:	Yes
Local:	No
Published:	Nov 25 2013 12:00AM
Updated:	Nov 25 2013 12:00AM
Credit:	Vendor reported these issues.
Vulnerable:	Open-Xchange Open-Xchange AppSuite 7.4 Open-Xchange Open-Xchange AppSuite 6.22.4 Open-Xchange Open-Xchange AppSuite 6.22.1 Open-Xchange Open-Xchange AppSuite 6.22
Not Vulnerable:	Open-Xchange Open-Xchange AppSuite 7.4.0-rev20 Open-Xchange Open-Xchange AppSuite 7.4.0-rev16 Open-Xchange Open-Xchange AppSuite 7.2.2-rev27 Open-Xchange Open-Xchange AppSuite 7.2.2-rev26 Open-Xchange Open-Xchange AppSuite 6.22.4-rev12 Open-Xchange Open-Xchange AppSuite 6.22.3-rev5

Open-Xchange AppSuite CVE-2013-6242 Multiple HTML Injection and Cross Site Scripting Vulnerabilities

Open-Xchange AppSuite is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Open-Xchange AppSuite CVE-2013-6242 Multiple HTML Injection and Cross Site Scripting Vulnerabilities

Attackers can use a browser to exploit these issues.

Open-Xchange AppSuite CVE-2013-6242 Multiple HTML Injection and Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Open-Xchange AppSuite CVE-2013-6242 Multiple HTML Injection and Cross Site Scripting Vulnerabilities

References:

• Open-Xchange Homepage (Open-Xchange AG)
  
• Open-Xchange Security Advisory 2013-11-25 (Seclists)