CVE-2016-3174

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27

published December 15, 2016

CVSS
—
EPSS
1%
Percentile
60.9
In the wild
Unconfirmed
What it is

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The "defer" servlet offers to redirect a client to a specified URL. Since some checks were missing, arbitrary URLs could be provided as redirection target. Users can be tricked to follow a link to a trustworthy domain but end up at an unexpected service later on. This vulnerability can be used to prepare and enhance phishing attacks.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00960 · 60.9th percentile
Published
2016-12-15T06:31Z
EPSS history
Timeline
  • 15 DEC 06:31Z
    An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27
    cvelistv5