CVE-2013-1648: open-xchange open-xchange_server Improper Input Validation

Vulnerability summary

CVE-2013-1648 is a low (CVSS 3.5) Improper Input Validation vulnerability in open-xchange open-xchange_server. EPSS estimates a 1.33% chance of exploitation in the next 30 days, higher than 70.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 05-09-2013
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allows remote authenticated users to trigger arbitrary outbound TCP traffic via a crafted Source field, as demonstrated by (1) an ftp: URL, (2) a gopher: URL, or (3) an http://127.0.0.1/ URL, related to a "Server-side request forging (SSRF)" issue.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.