CVE-2013-1647: open-xchange open-xchange_server Code Injection

Vulnerability summary

CVE-2013-1647 is a medium (CVSS 5.0) Code Injection vulnerability in open-xchange open-xchange_server. EPSS estimates a 1.72% chance of exploitation in the next 30 days, higher than 77.2% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 05-09-2013
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Multiple CRLF injection vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter, as demonstrated by (1) the location parameter to ajax/redirect or (2) multiple infostore URIs.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.