CVE-2014-2391: Infoleak
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potentially useful password-pattern information by reading (1) a web-server access log, (2) a web-server Referer log, or (3) browser history that contains this string because of its presence in a GET request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2391?
CVE-2014-2391 is classified as a medium severity vulnerability.
How do I fix CVE-2014-2391?
To fix CVE-2014-2391, upgrade Open-Xchange AppSuite to version 7.2.2-rev20, 7.4.1-rev11, or 7.4.2-rev13 or later.
What types of systems are affected by CVE-2014-2391?
CVE-2014-2391 affects Open-Xchange AppSuite versions 7.2.0, 7.2.1, 7.4.1, and 7.4.2.
What does CVE-2014-2391 exploit?
CVE-2014-2391 exploits a flaw in the password recovery service due to the improper handling of previously used passwords.
Are any specific actions required to prevent CVE-2014-2391 exploitation?
To prevent exploitation of CVE-2014-2391, users should ensure their Open-Xchange AppSuite is updated to the recommended versions.