CVE-2018-9998: Infoleak
Published Jul 5, 2018
·Updated
Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks.
Affected Software
89 affected components
Open-Xchange Open-Xchange AppSuite<=7.6.3
Open-Xchange Open-Xchange AppSuite=7.6.3-rev14
Open-Xchange Open-Xchange AppSuite=7.6.3-rev15
Open-Xchange Open-Xchange AppSuite=7.6.3-rev16
Open-Xchange Open-Xchange AppSuite=7.6.3-rev17
Open-Xchange Open-Xchange AppSuite=7.6.3-rev18
Open-Xchange Open-Xchange AppSuite=7.6.3-rev20
Open-Xchange Open-Xchange AppSuite=7.6.3-rev22
Open-Xchange Open-Xchange AppSuite=7.6.3-rev23
Open-Xchange Open-Xchange AppSuite=7.6.3-rev24
Open-Xchange Open-Xchange AppSuite=7.6.3-rev25
Open-Xchange Open-Xchange AppSuite=7.6.3-rev26
Open-Xchange Open-Xchange AppSuite=7.6.3-rev28
Open-Xchange Open-Xchange AppSuite=7.6.3-rev29
Open-Xchange Open-Xchange AppSuite=7.6.3-rev30
Open-Xchange Open-Xchange AppSuite=7.6.3-rev31
Open-Xchange Open-Xchange AppSuite=7.6.3-rev32
Open-Xchange Open-Xchange AppSuite=7.6.3-rev33
Open-Xchange Open-Xchange AppSuite=7.6.3-rev35
Open-Xchange Open-Xchange AppSuite=7.6.3-rev36
Open-Xchange Open-Xchange AppSuite=7.8.0
Open-Xchange Open-Xchange AppSuite=7.8.2
Open-Xchange Open-Xchange AppSuite=7.8.3
Open-Xchange Open-Xchange AppSuite=7.8.3-rev10
Open-Xchange Open-Xchange AppSuite=7.8.3-rev11
Open-Xchange Open-Xchange AppSuite=7.8.3-rev12
Open-Xchange Open-Xchange AppSuite=7.8.3-rev13
Open-Xchange Open-Xchange AppSuite=7.8.3-rev14
Open-Xchange Open-Xchange AppSuite=7.8.3-rev15
Open-Xchange Open-Xchange AppSuite=7.8.3-rev16
Open-Xchange Open-Xchange AppSuite=7.8.3-rev17
Open-Xchange Open-Xchange AppSuite=7.8.3-rev18
Open-Xchange Open-Xchange AppSuite=7.8.3-rev19
Open-Xchange Open-Xchange AppSuite=7.8.3-rev20
Open-Xchange Open-Xchange AppSuite=7.8.3-rev21
Open-Xchange Open-Xchange AppSuite=7.8.3-rev22
Open-Xchange Open-Xchange AppSuite=7.8.3-rev23
Open-Xchange Open-Xchange AppSuite=7.8.3-rev24
Open-Xchange Open-Xchange AppSuite=7.8.3-rev25
Open-Xchange Open-Xchange AppSuite=7.8.3-rev26
Open-Xchange Open-Xchange AppSuite=7.8.3-rev27
Open-Xchange Open-Xchange AppSuite=7.8.3-rev28
Open-Xchange Open-Xchange AppSuite=7.8.3-rev29
Open-Xchange Open-Xchange AppSuite=7.8.3-rev30
Open-Xchange Open-Xchange AppSuite=7.8.3-rev31
Open-Xchange Open-Xchange AppSuite=7.8.3-rev32
Open-Xchange Open-Xchange AppSuite=7.8.3-rev33
Open-Xchange Open-Xchange AppSuite=7.8.3-rev34
Open-Xchange Open-Xchange AppSuite=7.8.3-rev35
Open-Xchange Open-Xchange AppSuite=7.8.3-rev36
Open-Xchange Open-Xchange AppSuite=7.8.3-rev38
Open-Xchange Open-Xchange AppSuite=7.8.3-rev39
Open-Xchange Open-Xchange AppSuite=7.8.3-rev40
Open-Xchange Open-Xchange AppSuite=7.8.3-rev41
Open-Xchange Open-Xchange AppSuite=7.8.3-rev42
Open-Xchange Open-Xchange AppSuite=7.8.3-rev43
Open-Xchange Open-Xchange AppSuite=7.8.3-rev44
Open-Xchange Open-Xchange AppSuite=7.8.3-rev45
Open-Xchange Open-Xchange AppSuite=7.8.3-rev46
Open-Xchange Open-Xchange AppSuite=7.8.3-rev47
Open-Xchange Open-Xchange AppSuite=7.8.3-rev5
Open-Xchange Open-Xchange AppSuite=7.8.3-rev6
Open-Xchange Open-Xchange AppSuite=7.8.3-rev8
Open-Xchange Open-Xchange AppSuite=7.8.3-rev9
Open-Xchange Open-Xchange AppSuite=7.8.4
Open-Xchange Open-Xchange AppSuite=7.8.4-rev10
Open-Xchange Open-Xchange AppSuite=7.8.4-rev11
Open-Xchange Open-Xchange AppSuite=7.8.4-rev13
Open-Xchange Open-Xchange AppSuite=7.8.4-rev14
Open-Xchange Open-Xchange AppSuite=7.8.4-rev15
Open-Xchange Open-Xchange AppSuite=7.8.4-rev16
Open-Xchange Open-Xchange AppSuite=7.8.4-rev17
Open-Xchange Open-Xchange AppSuite=7.8.4-rev18
Open-Xchange Open-Xchange AppSuite=7.8.4-rev19
Open-Xchange Open-Xchange AppSuite=7.8.4-rev20
Open-Xchange Open-Xchange AppSuite=7.8.4-rev21
Open-Xchange Open-Xchange AppSuite=7.8.4-rev22
Open-Xchange Open-Xchange AppSuite=7.8.4-rev23
Open-Xchange Open-Xchange AppSuite=7.8.4-rev24
Open-Xchange Open-Xchange AppSuite=7.8.4-rev25
Open-Xchange Open-Xchange AppSuite=7.8.4-rev26
Open-Xchange Open-Xchange AppSuite=7.8.4-rev27
Open-Xchange Open-Xchange AppSuite=7.8.4-rev3
Open-Xchange Open-Xchange AppSuite=7.8.4-rev4
Open-Xchange Open-Xchange AppSuite=7.8.4-rev5
Open-Xchange Open-Xchange AppSuite=7.8.4-rev6
Open-Xchange Open-Xchange AppSuite=7.8.4-rev7
Open-Xchange Open-Xchange AppSuite=7.8.4-rev8
Open-Xchange Open-Xchange AppSuite=7.8.4-rev9
Event History
Jul 5, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Data Sourced
via NVD·08:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-9998?
CVE-2018-9998 is classified as a medium severity vulnerability due to its potential for information leakage.
2
How do I fix CVE-2018-9998?
To fix CVE-2018-9998, upgrade your Open-Xchange OX App Suite to version 7.6.3-rev37, 7.8.2-rev40, or newer.
3
What systems are affected by CVE-2018-9998?
CVE-2018-9998 affects Open-Xchange OX App Suite versions before 7.6.3-rev37, 7.8.2-rev40, and 7.8.3-rev48.
4
What kind of information can be leaked due to CVE-2018-9998?
CVE-2018-9998 allows remote attackers to obtain sensitive folder names through API error responses.
5
Is CVE-2018-9998 an API-related vulnerability?
Yes, CVE-2018-9998 is related to the Open-Xchange API, specifically through the handling of error responses.