CVE-2013-6997: XSS
First published: Thu Jan 09 2014(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing "crafted hyperlinks with script URL handlers."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-Xchange App Suite Backend | <=7.4.0 | |
| Open-Xchange App Suite Backend | =6.20.7 | |
| Open-Xchange App Suite Backend | =6.22.0 | |
| Open-Xchange App Suite Backend | =6.22.1 | |
| Open-Xchange App Suite Backend | =7.0.1 | |
| Open-Xchange App Suite Backend | =7.0.2 | |
| Open-Xchange App Suite Backend | =7.2.0 | |
| Open-Xchange App Suite Backend | =7.2.1 | |
| Open-Xchange App Suite Backend | =7.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://software.open-xchange.com/OX6/doc/Release_Notes_for_Public_Patch_Release_1766_7.4.0_Rev21_2013_12_13.pdf
- http://www.osvdb.org/101714
- http://www.osvdb.org/101715
- http://www.securityfocus.com/archive/1/530681/100/0/threaded
- http://www.securityfocus.com/bid/64676
- http://www.securitytracker.com/id/1029554
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90113
Frequently Asked Questions
What is the severity of CVE-2013-6997?
CVE-2013-6997 has a medium severity rating due to its potential for cross-site scripting exploits.
How do I fix CVE-2013-6997?
To fix CVE-2013-6997, update your Open-Xchange AppSuite to version 7.4.1 or later, which addresses the vulnerabilities.
What types of attacks are associated with CVE-2013-6997?
CVE-2013-6997 is associated with cross-site scripting (XSS) attacks that allow remote attackers to inject malicious scripts.
Which versions of Open-Xchange AppSuite are affected by CVE-2013-6997?
CVE-2013-6997 affects Open-Xchange AppSuite versions 7.4.0 and earlier, as well as specific earlier versions like 6.20.7, 6.22.0, and 7.0.X.
Is CVE-2013-6997 a known issue in Open-Xchange?
Yes, CVE-2013-6997 is a documented vulnerability in Open-Xchange that has been acknowledged and addressed by the developers.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- vendor/open-xchange
- canonical/open-xchange app suite backend
- version/open-xchange app suite backend/7.4.0
- version/open-xchange app suite backend/6.20.7
- version/open-xchange app suite backend/6.22.0
- version/open-xchange app suite backend/6.22.1
- version/open-xchange app suite backend/7.0.1
- version/open-xchange app suite backend/7.0.2
- version/open-xchange app suite backend/7.2.0
- version/open-xchange app suite backend/7.2.1
- version/open-xchange app suite backend/7.2.2