CVE-2014-2392

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite versions prior to 7.2.2-rev20 Open-Xchange AppSuite versions prior to 7.4.1-rev11 Open-Xchange AppSuite versions prior to 7.4.2-rev13

Description The E-Mail autoconfiguration feature in Open-Xchange AppSuite places a password in a GET request. This allows remote attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history.

Recommendations For versions prior to 7.2.2-rev20, update to version 7.2.2-rev20 or later. For versions prior to 7.4.1-rev11, update to version 7.4.1-rev11 or later. For versions prior to 7.4.2-rev13, update to version 7.4.2-rev13 or later.