ID de Prueba:	1.3.6.1.4.1.25623.1.0.803182
Categoría:	Web application abuses
Título:	Open-Xchange Server Multiple Vulnerabilities (Mar 2013) - Active Check
Resumen:	Open-Xchange Server is prone to multiple vulnerabilities.
Descripción:	Summary: Open-Xchange Server is prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - Input passed via arbitrary GET parameters to /servlet/TestServlet is not properly sanitized before being returned to the user. - Input related to the 'Source' field when creating subscriptions is not properly sanitized before being used. This can be exploited to perform arbitrary HTTP GET requests to remote and local servers. - The OXUpdater component does not properly validate the SSL certificate of an update server. This can be exploited to spoof update packages via a MitM (Man-in-the-Middle) attack. - The application creates the /opt/open-exchange/etc directory with insecure world-readable permissions. This can be exploited to disclose certain sensitive information. - Input passed via the 'location' GET parameter to /ajax/redirect is not properly sanitized before being used to construct HTTP response headers. - Certain input related to RSS feed contents is not properly sanitized before being used. This can be exploited to insert arbitrary HTML and script code. Affected Software/OS: Open-Xchange Server versions prior to 6.20.7-rev14, 6.22.0-rev13 and 6.22.1-rev14. Solution: Update to versions 6.20.7-rev14, 6.22.0-rev13, 6.22.1-rev14 or later. CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1646 Bugtraq: 20130313 Open-Xchange Security Advisory 2013-03-13 (Google Search) http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html Common Vulnerability Exposure (CVE) ID: CVE-2013-1647 Common Vulnerability Exposure (CVE) ID: CVE-2013-1648 Common Vulnerability Exposure (CVE) ID: CVE-2013-1650 Common Vulnerability Exposure (CVE) ID: CVE-2013-1651
Copyright	Copyright (C) 2013 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.