CVE-2016-4027: Infoleak
First published: Thu Dec 15 2016(Updated: )
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10. App Suite frontend offers to control whether a user wants to store cookies that exceed the session duration. This functionality is useful when logging in from clients with reduced privileges or shared environments. However the setting was incorrectly recognized and cookies were stored regardless of this setting when the login was performed using a non-interactive login method. In case the setting was enforced by middleware configuration or the user went through the interactive login page, the workflow was correct. Cookies with authentication information may become available to other users on shared environments. In case the user did not properly log out from the session, third parties with access to the same client can access a user's account.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-Xchange App Suite Backend | <=7.8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-4027?
CVE-2016-4027 is classified as a medium severity issue due to its potential for information disclosure.
How do I fix CVE-2016-4027?
To fix CVE-2016-4027, upgrade to Open-Xchange App Suite version 7.8.1-rev10 or later.
What causes CVE-2016-4027?
CVE-2016-4027 is caused by improper handling of cookie storage options within the Open-Xchange App Suite.
Is CVE-2016-4027 exploitable in shared environments?
Yes, CVE-2016-4027 can be exploited in shared environments where user cookie storage is improperly managed.
What versions are affected by CVE-2016-4027?
CVE-2016-4027 affects Open-Xchange App Suite versions before 7.8.1-rev10.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/open-xchange
- canonical/open-xchange app suite backend
- version/open-xchange app suite backend/7.8.1