CVE-2013-6242

moderate-risk
Published 2020-01-02

Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and the publication name were SPLIT from this CVE ID because they affect different sets of versions.

Do I need to act?

-
0.75% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Open-Xchange

References (10)

Third Party Advisory http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backen...
Mailing List http://seclists.org/bugtraq/2013/Nov/127
Third Party Advisory http://www.securitytracker.com/id/1029394
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/89250
Vendor Advisory https://forum.open-xchange.com/showthread.php?8115-Open-Xchange-releases-Securit...
Third Party Advisory http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backen...
Mailing List http://seclists.org/bugtraq/2013/Nov/127
Third Party Advisory http://www.securitytracker.com/id/1029394
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/89250
Vendor Advisory https://forum.open-xchange.com/showthread.php?8115-Open-Xchange-releases-Securit...
36
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 3/34 · Minimal
Exposure 10/34 · Low