CVE-2016-3174: High severity open-xchange app suite backend vulnerability
An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The "defer" servlet offers to redirect a client to a specified URL. Since some checks were missing, arbitrary URLs could be provided as redirection target. Users can be tricked to follow a link to a trustworthy domain but end up at an unexpected service later on. This vulnerability can be used to prepare and enhance phishing attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3174?
CVE-2016-3174 is classified as a medium severity vulnerability due to its potential for causing phishing attacks.
How do I fix CVE-2016-3174?
To fix CVE-2016-3174, upgrade Open-Xchange AppSuite to version 7.8.0-rev27 or later.
What type of vulnerability is CVE-2016-3174?
CVE-2016-3174 is a security flaw that involves open redirection allowing attackers to manipulate URLs.
What versions of Open-Xchange AppSuite are affected by CVE-2016-3174?
Open-Xchange AppSuite versions before 7.8.0-rev27 are affected by CVE-2016-3174.
Can CVE-2016-3174 be exploited in a phishing attack?
Yes, CVE-2016-3174 can be exploited in phishing attacks by redirecting users to malicious sites while appearing legitimate.