CVEvulnerability
CVE-2016-6189
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-02-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-184
Description
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
Affected configurations
• alinto sogo (< 2.3.12)
• alinto sogo (>= 3.0.0 < 3.1.1)
Related
Weakness · CWE (1)
- CWE-184 Incomplete List of Disallowed Inputs weakness
References
- http://www.openwall.com/lists/oss-security/2016/07/09/3 Mailing List, VDB Entry
- https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225 Patch
- https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d Patch
- https://sogo.nu/bugs/view.php?id=3695 Exploit, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2016/07/09/3 Mailing List, VDB Entry
- https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225 Patch
- https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d Patch
- https://sogo.nu/bugs/view.php?id=3695 Exploit, Vendor Advisory