CVEvulnerability

CVE-2016-4046

5.8 MEDIUM Published 2016-12-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-12-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.8 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-918

Description

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response type, content and latency, information about existence of hosts and services can be gathered. Attackers can get internal configuration information about the infrastructure of an operator to prepare subsequent attacks.

Affected configurations

• open-xchange open-xchange appsuite (<= 7.8.1)

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References