CVE-2015-1588
CVSS4.3
发布时间 :2017-06-08 17:29:00
修订时间 :2017-06-15 15:37:55
NMCP    

[原文]Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21.


[CNNVD]Open-Xchange Server和Open-Xchange AppSuite 跨站脚本漏洞(CNNVD-201504-572)

        

Open-Xchange Server和Open-Xchange AppSuite(OX AppSuite)都是美国Open-Xchange公司的产品。Open-Xchange Server是一个主要用于开发协同软件的半开源项目;OX AppSuite是一套Web云桌面环境。

Open-Xchange Server 7.6.1及之前版本和OX App Suite 7.6.1及之前版本中存在跨站脚本漏洞,该漏洞源于程序没有充分过滤用户提交的输入。攻击者可利用该漏洞在受影响站点上下文的用户浏览器会话中插入并执行任意HTML或脚本代码。

- CVSS (基础分值)

CVSS分值: 4.3 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: MEDIUM [漏洞利用存在一定的访问条件]
攻击向量: NETWORK [攻击者不需要获取内网访问权或本地访问权]
身份认证: NONE [漏洞利用无需身份认证]

- CWE (弱点类目)

CWE-79 [在Web页面生成时对输入的转义处理不恰当(跨站脚本)]

- CPE (受影响的平台与产品)

cpe:/a:open-xchange:open-xchange_server:6.22.12
cpe:/a:open-xchange:open-xchange_appsuite:7.6.0
cpe:/a:open-xchange:open-xchange_appsuite:7.4.2
cpe:/a:open-xchange:open-xchange_appsuite:7.6.1
cpe:/a:open-xchange:open-xchange_server:6.0
cpe:/a:open-xchange:open-xchange_server:6.22.13

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1588
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1588
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-201504-572
(官方数据源) CNNVD

- 其它链接及资源

http://packetstormsecurity.com/files/131649/Open-Xchange-Server-6-OX-AppSuite-Cross-Site-Scripting.html
(VENDOR_ADVISORY)  MISC  http://packetstormsecurity.com/files/131649/Open-Xchange-Server-6-OX-AppSuite-Cross-Site-Scripting.html
http://www.securityfocus.com/archive/1/archive/1/535388/100/1100/threaded
(VENDOR_ADVISORY)  BUGTRAQ  20150427 Open-Xchange Security Advisory 2015-04-27
http://www.securityfocus.com/bid/74350
(VENDOR_ADVISORY)  BID  74350
http://www.securitytracker.com/id/1032202
(VENDOR_ADVISORY)  SECTRACK  1032202

- 漏洞信息

Open-Xchange Server和Open-Xchange AppSuite 跨站脚本漏洞
跨站脚本
2015-04-29 00:00:00 2015-04-29 00:00:00
远程  
        

Open-Xchange Server和Open-Xchange AppSuite(OX AppSuite)都是美国Open-Xchange公司的产品。Open-Xchange Server是一个主要用于开发协同软件的半开源项目;OX AppSuite是一套Web云桌面环境。

Open-Xchange Server 7.6.1及之前版本和OX App Suite 7.6.1及之前版本中存在跨站脚本漏洞,该漏洞源于程序没有充分过滤用户提交的输入。攻击者可利用该漏洞在受影响站点上下文的用户浏览器会话中插入并执行任意HTML或脚本代码。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接:
        http://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_2406_7.6.1_2015-03-02.pdf
        http://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_2407_7.6.0_2015-03-02.pdf
        http://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_2408_7.4.2_2015-03-02.pdf

- 漏洞信息 (F131649)

Open-Xchange Server 6 / OX AppSuite Cross Site Scripting (PacketStormID:F131649)
2015-04-27 00:00:00
Martin Heiland  
advisory,vulnerability,xss
CVE-2015-1588
[点击下载]

Open-Xchange Server 6 and OX AppSuite versions 7.6.1 and below suffer from multiple cross site scripting vulnerabilities.

Product: Open-Xchange Server 6 / OX AppSuite
Vendor: Open-Xchange GmbH

Internal reference: 35982 (Bug ID)
Vulnerability type: Cross-Site Scripting (CWE-80)
Vulnerable version: 7.6.1
Vulnerable component: backend
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 7.6.1-rev21
Vendor notification: 2015-01-07
Solution date: 2015-03-02
CVE reference: CVE-2015-1588
CVSSv2: 5.7 (AV:N/AC:M/Au:N/C:P/I:N/A:N/E:POC/RL:U/RC:C/CDP:LM/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
The sanitation and cleaner engine of OX AppSuite can be exploitet to return valid script code that gets executed by certain browsers. Such filter evasion requires rather good kowledge of the filtering algorithm and carefully crafted script code.

Risk:
Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). Potential attack vectors are E-Mail (via attachments) or Drive.

Solution:
Users should update to the latest patch releases 7.6.1-rev21 (or later).



Internal reference: 36024 (Bug ID)
Vulnerability type: Cross-Site Scripting (CWE-80)
Vulnerable version: 7.6.1 and earlier
Vulnerable component: backend
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 7.4.2-rev43, 7.6.0-rev38, 7.6.1-rev21
Vendor notification: 2015-01-09
Solution date: 2015-03-02
CVE reference: CVE-2015-1588
CVSSv2: 4.1 (AV:N/AC:M/Au:N/C:P/I:N/A:N/E:F/RL:U/RC:C/CDP:ND/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
Inline-styles of HTML content can be used to place a element at the complete viewport of the application. This element can be a hyperlink which may trick users to trust third party and potentially malicious content.

Risk:
The application can become unresponsible or unusable when selecting certain contant. Furthermore, users may get tricked to open hyperlinks or consume injected content (images, text) at unexpected places of the application for unsolicited advertising and social-engineering attacks.

Solution:
Users should update to the latest patch releases 7.4.2-rev43, 7.6.0-rev38, 7.6.1-rev21 (or later).
    
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站