{"schemaVersion":3,"id":"CVE-2016-6851","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.) in case the user has an active session on the same domain already.","dates":{"published":"2016-12-15T06:31:00.000Z","modified":"2024-08-06T01:43:37.806Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.1,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02643,"percentile":0.85391,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.02643},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03281,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02643,"percentile":0.85391}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03281,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02643,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02643,"percentile":0.85391}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_56950E30972A57DD","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"40377","name":"Open-Xchange Guard 2.4.2 - Multiple Cross-Site Scripting Vulnerabilities","source":"exploit-database","url":"https://www.exploit-db.com/exploits/40377","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["linux"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"linux","file":"exploits/linux/webapps/40377.txt","codes":["CVE-2016-6854","CVE-2016-6853","CVE-2016-6851"]},"metasploit":null}],"exploitCount":2,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"open-xchange","product":"ox_guard","name":"ox guard","label":"ox_guard","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.4.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.4.2","eol":null,"hubHref":"/vendor/open-xchange/ox_guard"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/92920","label":"www.securityfocus.com/bid/92920","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.html","label":"packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.html","hostname":"packetstormsecurity.com","tags":["X Refsource CONFIRM","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40377/","label":"www.exploit-db.com/exploits/40377/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/539395/100/0/threaded","label":"www.securityfocus.com/archive/1/539395/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2016-12-15T06:31:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T01:43:37.806Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":35,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T02:31:15.274Z","stale":false,"partial":false}}