CVE-2016-6189: Medium severity alinto SOGo vulnerability
Published Feb 17, 2017
·Updated
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
Affected Software
2 affected components
alinto SOGo<2.3.12
alinto SOGo>=3.0.0<3.1.1
Remediation
Event History
Feb 17, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-6189?
CVE-2016-6189 has a medium severity level as it allows unauthorized access to sensitive information by authenticated users.
2
How do I fix CVE-2016-6189?
To fix CVE-2016-6189, upgrade SOGo to version 2.3.12 or 3.1.1 or later.
3
What impact does CVE-2016-6189 have on SOGo?
CVE-2016-6189 can lead to information disclosure through insecure ICS or XML calendar feeds.
4
Is CVE-2016-6189 a remote vulnerability?
Yes, CVE-2016-6189 is a remote vulnerability that affects authenticated users accessing calendar feeds.
5
Which versions of SOGo are affected by CVE-2016-6189?
SOGo versions prior to 2.3.12 and between 3.0.0 and 3.1.0 are affected by CVE-2016-6189.