CVE-2016-2840: open-xchange open-xchange_appsuite Cross-site Scripting
Vulnerability summary
CVE-2016-2840 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in open-xchange open-xchange_appsuite. EPSS estimates a 1.64% chance of exploitation in the next 30 days, higher than 76.1% of scored vulnerabilities.
Timeline
- 15-12-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject script code that gets reflected through the subsequent status page. Malicious script code can be executed within a trusted domain's context. While no OX App Suite specific data can be manipulated, the vulnerability can be exploited without being authenticated and therefore used for social engineering attacks, stealing cookies or redirecting from trustworthy to malicious hosts.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.64%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.64% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Open-xchange1 product
- open-xchange_appsuite≤ 7.8.0
1 vendor · 1 product
References
3 links- packetstormsecurity.com/files/136543/Open-Xchange-7.8.0-Cross-Site-Scripting.htmlX Refsource CONFIRMThird Party AdvisoryVDB Entry