CVE-2016-6850: XSS
First published: Thu Dec 15 2016(Updated: )
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as profile pictures. In case their XML structure contains iframes and script code, that code may get executed when calling the related picture URL or viewing the related person's image within a browser. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-Xchange App Suite Backend | <=7.8.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-6850?
CVE-2016-6850 has a medium severity rating due to potential cross-site scripting vulnerabilities.
How do I fix CVE-2016-6850?
To fix CVE-2016-6850, upgrade Open-Xchange OX App Suite to version 7.8.2-rev9 or later.
Which versions of Open-Xchange App Suite are affected by CVE-2016-6850?
CVE-2016-6850 affects Open-Xchange App Suite versions prior to 7.8.2-rev9.
What type of attack does CVE-2016-6850 enable?
CVE-2016-6850 enables an attacker to execute arbitrary script code via specially crafted SVG files.
Is CVE-2016-6850 a vulnerability in third-party software?
No, CVE-2016-6850 is a vulnerability specific to the Open-Xchange OX App Suite.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/open-xchange
- canonical/open-xchange app suite backend
- version/open-xchange app suite backend/7.8.2