CVE-2013-6997

Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing "crafted hyperlinks with script URL handlers."
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 63%
VendorProductVersion
open-xchangeopen-xchange_appsuite
𝑥
≤ 7.4.0
open-xchangeopen-xchange_appsuite
6.20.7
open-xchangeopen-xchange_appsuite
6.22.0
open-xchangeopen-xchange_appsuite
6.22.1
open-xchangeopen-xchange_appsuite
7.0.1
open-xchangeopen-xchange_appsuite
7.0.2
open-xchangeopen-xchange_appsuite
7.2.0
open-xchangeopen-xchange_appsuite
7.2.1
open-xchangeopen-xchange_appsuite
7.2.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://software.open-xchange.com/OX6/doc/Release_Notes_for_Public_Patch_Release_1766_7.4.0_Rev21_2013_12_13.pdf
http://www.osvdb.org/101714
http://www.osvdb.org/101715
http://www.securityfocus.com/archive/1/530681/100/0/threaded
http://www.securityfocus.com/bid/64676
http://www.securitytracker.com/id/1029554
https://exchange.xforce.ibmcloud.com/vulnerabilities/90113
http://software.open-xchange.com/OX6/doc/Release_Notes_for_Public_Patch_Release_1766_7.4.0_Rev21_2013_12_13.pdf
http://www.osvdb.org/101714
http://www.osvdb.org/101715
http://www.securityfocus.com/archive/1/530681/100/0/threaded
http://www.securityfocus.com/bid/64676
http://www.securitytracker.com/id/1029554
https://exchange.xforce.ibmcloud.com/vulnerabilities/90113