CVE-2013-3106: Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2…

Unscored severity · published Sep 5, 2013

CVE-2013-3106

Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2…

–

CVSS

0.9%

EPSS

On KEV

Description

Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allow remote attackers to inject arbitrary web script or HTML via (1) embedded VBScript, (2) object/data Base64 content, (3) a Content-Type header, or (4) UTF-16 encoding, aka Bug IDs 25957, 26237, 26243, and 26244.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.9% · higher than 61% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Open-xchange Appsuite · Open-xchange

6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; 7.2.0 · source: NVD

Open-xchange Server · Open-xchange

6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; 7.2.0 · source: NVD