CVEvulnerability

CVE-2016-6190

4.3 MEDIUM Published 2017-02-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-02-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
4.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-200

Description

SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.

Affected configurations

• inverse-inc sogo (<= 2.3.11) • inverse-inc sogo 3.0.0 • inverse-inc sogo 3.0.1 • inverse-inc sogo 3.0.2 • inverse-inc sogo 3.1.0

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References