CVE-2016-5740: open-xchange open-xchange_appsuite Cross-site Scripting
Vulnerability summary
CVE-2016-5740 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in open-xchange open-xchange_appsuite. EPSS estimates a 4.27% chance of exploitation in the next 30 days, higher than 91% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 15-12-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5. JavaScript code can be used as part of ical attachments within scheduling E-Mails. This content, for example an appointment's location, will be presented to the user at the E-Mail App, depending on the invitation workflow. This code gets executed within the context of the user's current session. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
4.27%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.27% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundOpen-Xchange App Suite 7.8.2 - Cross-Site Scripting
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Open-xchange1 product
- open-xchange_appsuite≤ 7.8.2
1 vendor · 1 product
References
4 links- www.exploit-db.com/exploits/40378/ExploitX Refsource EXPLOIT DBMitigationThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/138700/Open-Xchange-App-Suite-7.8.2-Cross-Site-Scripting.htmlX Refsource CONFIRMMitigationThird Party AdvisoryVDB Entry