CVE-2016-6848: open-xchange open-xchange_appsuite 7PK - Security Features
Vulnerability summary
CVE-2016-6848 is a medium (CVSS 5.5) 7PK - Security Features vulnerability in open-xchange open-xchange_appsuite. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities.
Timeline
- 15-12-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client ("Reflected File Download"). Malicious platform specific (e.g. Microsoft Windows) batch file can be created via a trusted domain without authentication that, if executed by the user, may lead to local code execution.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.43% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Open-xchange1 product
- open-xchange_appsuite≤ 7.8.2
1 vendor · 1 product
References
2 links- software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3522_7.8.2_2016-08-29.pdfX Refsource CONFIRMRelease NotesVendor Advisory