Alan Watt

Name of the Vulnerable Software and Affected Versions: Open-Xchange OX App Suite versions prior to 7.6.3-rev36 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev39 Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev44 Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev22 Description: The issue allows remote attackers to conduct server-side request forgery (SSRF) attacks. This is achieved via vectors involving non-decimal representations of IP addresses and special IPv6 related addresses. Recommendations: For Open-Xchange OX App Suite versions prior to 7.6.3-rev36, update to version 7.6.3-rev36 or later. For Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev39, update to version 7.8.2-rev39 or later. For Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev44, update to version 7.8.3-rev44 or later. For Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev22, update to version 7.8.4-rev22 or later.

Name of the Vulnerable Software and Affected Versions: Open-Xchange OX App Suite versions prior to 7.6.3-rev35 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev38 Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev41 Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev19 Description: The issue allows remote authenticated users to save arbitrary user attributes due to improper privilege management in the backend component. Recommendations: For Open-Xchange OX App Suite versions prior to 7.6.3-rev35, update to version 7.6.3-rev35 or later. For Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev38, update to version 7.8.2-rev38 or later. For Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev41, update to version 7.8.3-rev41 or later. For Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev19, update to version 7.8.4-rev19 or later.