CVE-2016-6854: XSS
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6854?
CVE-2016-6854 is considered a medium severity vulnerability due to the potential for session hijacking.
How do I fix CVE-2016-6854?
To fix CVE-2016-6854, upgrade Open-Xchange OX Guard to version 2.4.2-rev5 or later.
What impact does CVE-2016-6854 have on users?
CVE-2016-6854 can lead to the execution of malicious scripts in a user's context, posing risks such as session hijacking.
Is CVE-2016-6854 exploitable in all versions of Open-Xchange OX Guard?
CVE-2016-6854 is exploitable in versions of Open-Xchange OX Guard prior to 2.4.2-rev5.
What are the potential consequences of CVE-2016-6854?
The consequences of CVE-2016-6854 include unauthorized access, data theft, and compromise of user sessions.