Open-Xchange Server and OX App Suite CVE-2015-1588 Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	74350
Class:	Input Validation Error
CVE:	CVE-2015-1588
Remote:	Yes
Local:	No
Published:	Apr 27 2015 12:00AM
Updated:	Apr 27 2015 12:00AM
Credit:	Martin Heiland
Vulnerable:	Open-Xchange Open-Xchange Server 6 7.6.1 Open-Xchange Open-Xchange Server 6 7.6 Open-Xchange Open-Xchange Server 6 7.6.0-rev38 Open-Xchange Open-Xchange Server 6 7.6.0-rev36 Open-Xchange Open-Xchange Server 6 7.6.0-rev32 Open-Xchange Open-Xchange Server 6 7.4.2-rev43 Open-Xchange Open-Xchange Server 6 7.4.2-rev42 Open-Xchange Open-Xchange Server 6 7.4.2-rev40 Open-Xchange Open-Xchange Server 6 6.22.2-rev6 Open-Xchange Open-Xchange Server 6 6.22.1-rev19 Open-Xchange Open-Xchange Server 6 6.22.1-rev18 Open-Xchange Open-Xchange Server 6 6.22.1-rev17 Open-Xchange Open-Xchange Server 6 6.22.1-rev16 Open-Xchange Open-Xchange Server 6 6.22.1-rev15 Open-Xchange Open-Xchange Server 6 6.22.0-rev16 Open-Xchange Open-Xchange Server 6 6.22.0-rev15 Open-Xchange Open-Xchange Server 6 6.22.0-rev14 Open-Xchange Open-Xchange Server 6 6.20.7-rev18 Open-Xchange Open-Xchange Server 6 6.20.7-rev17 Open-Xchange Open-Xchange Server 6 6.20.7-rev16 Open-Xchange Open-Xchange Server 6 6.20.7-rev15 Open-Xchange Open-Xchange AppSuite 7.6.1 Open-Xchange Open-Xchange AppSuite 7.6 Open-Xchange Open-Xchange AppSuite 7.4.2 Open-Xchange Open-Xchange AppSuite 7.4 Open-Xchange Open-Xchange AppSuite 7.3 Open-Xchange Open-Xchange AppSuite 7.2.2 Open-Xchange Open-Xchange AppSuite 7.2.1 Open-Xchange Open-Xchange AppSuite 7.2 Open-Xchange Open-Xchange AppSuite 7.0.1 Open-Xchange Open-Xchange AppSuite 7.0 Open-Xchange Open-Xchange AppSuite 6.22.4 Open-Xchange Open-Xchange AppSuite 6.22.1 Open-Xchange Open-Xchange AppSuite 6.22 Open-Xchange Open-Xchange AppSuite 7.6.0-rev38 Open-Xchange Open-Xchange AppSuite 7.6.0-rev36 Open-Xchange Open-Xchange AppSuite 7.6.0-rev32 Open-Xchange Open-Xchange AppSuite 7.4.2-rev9 Open-Xchange Open-Xchange AppSuite 7.4.2-rev8 Open-Xchange Open-Xchange AppSuite 7.4.2-rev43 Open-Xchange Open-Xchange AppSuite 7.4.2-rev42 Open-Xchange Open-Xchange AppSuite 7.4.2-rev40 Open-Xchange Open-Xchange AppSuite 7.4.2-rev13 Open-Xchange Open-Xchange AppSuite 7.4.1-rev9 Open-Xchange Open-Xchange AppSuite 7.4.1-rev8 Open-Xchange Open-Xchange AppSuite 7.4.1-rev6 Open-Xchange Open-Xchange AppSuite 7.4.1-rev5 Open-Xchange Open-Xchange AppSuite 7.4.1-rev11 Open-Xchange Open-Xchange AppSuite 7.4.1-rev10 Open-Xchange Open-Xchange AppSuite 7.4.1 Open-Xchange Open-Xchange AppSuite 7.4.0-rev27 Open-Xchange Open-Xchange AppSuite 7.4.0-rev24 Open-Xchange Open-Xchange AppSuite 7.4.0-rev21 Open-Xchange Open-Xchange AppSuite 7.4.0-rev20 Open-Xchange Open-Xchange AppSuite 7.4.0-rev16 Open-Xchange Open-Xchange AppSuite 7.4.0-rev14 Open-Xchange Open-Xchange AppSuite 7.4.0-rev12 Open-Xchange Open-Xchange AppSuite 7.4.0-rev11 Open-Xchange Open-Xchange AppSuite 7.2.2-rev31 Open-Xchange Open-Xchange AppSuite 7.2.2-rev29 Open-Xchange Open-Xchange AppSuite 7.2.2-rev27 Open-Xchange Open-Xchange AppSuite 7.2.2-rev26 Open-Xchange Open-Xchange AppSuite 7.2.2-rev25 Open-Xchange Open-Xchange AppSuite 7.2.2-rev20 Open-Xchange Open-Xchange AppSuite 7.2.2-rev16 Open-Xchange Open-Xchange AppSuite 7.0.2-rev16 Open-Xchange Open-Xchange AppSuite 7.0.2-rev15 Open-Xchange Open-Xchange AppSuite 7.0.2 Open-Xchange Open-Xchange AppSuite 6.22.4-rev12 Open-Xchange Open-Xchange AppSuite 6.22.3-rev5 Open-Xchange Open-Xchange AppSuite 6.20.7 Open-Xchange Open-Xchange AppSuite 7.4.1-rev17
Not Vulnerable:	Open-Xchange Open-Xchange Server 6 7.6.1-rev21 Open-Xchange Open-Xchange Server 6 7.6.1-rev14 Open-Xchange Open-Xchange Server 6 7.6.1-rev11 Open-Xchange Open-Xchange AppSuite 7.6.1-rev21 Open-Xchange Open-Xchange AppSuite 7.6.1-rev14 Open-Xchange Open-Xchange AppSuite 7.6.1-rev11

Open-Xchange Server and OX App Suite CVE-2015-1588 Multiple Cross Site Scripting Vulnerabilities

Open-Xchange Server and OX App Suite are prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected application. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Open-Xchange Server and OX App Suite CVE-2015-1588 Multiple Cross Site Scripting Vulnerabilities

Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

Open-Xchange Server and OX App Suite CVE-2015-1588 Multiple Cross Site Scripting Vulnerabilities

References:

• Open-Xchange Homepage (Open-Xchange AG)
  
• Open-Xchange Security Advisory 2015-04-27 (Seclists.org)