Unscored severity · published Jan 9, 2014
CVE-2013-6997
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing "crafted hyperlinks with script URL handlers."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
Open-xchange Appsuite · Open-xchange
through 7.4.0; 6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6997
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6997
Vendor Advisory
http://software.open-xchange.com/OX6/doc/Release_Notes_for_Public_Patch_Release_1766_7.4.0_Rev21_2013_12_13.pdf
www.osvdb.org
http://www.osvdb.org/101714
www.osvdb.org
http://www.osvdb.org/101715
www.securityfocus.com
http://www.securityfocus.com/archive/1/530681/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/64676
www.securitytracker.com
http://www.securitytracker.com/id/1029554
More from Open-xchange Appsuite
9.9
CVE-2017-13667
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF
9.8
CVE-2020-12645
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption
9.8
CVE-2019-7158
OX App Suite 7.10.0 and earlier has Incorrect Access Control
9.8
CVE-2017-5212
Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control
9.8
CVE-2017-5210
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure