CVE-2013-2582

CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitization of whitespace characters.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2013-04/0183.html

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.0:::::::*
	cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.1:::::::*
	cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.1:::::::*
	cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.2:::::::*
	cpe:2.3:a:open-xchange:open-xchange_server:6.22.0:::::::*
	cpe:2.3:a:open-xchange:open-xchange_server:6.22.1:::::::*
	cpe:2.3:a:open-xchange:open-xchange_server:7.0.1:::::::*
	cpe:2.3:a:open-xchange:open-xchange_server:7.0.2:::::::*

History

No history.

Information

Published : 2013-09-05 11:44

Updated : 2024-02-28 12:00

NVD link : CVE-2013-2582

Mitre link : CVE-2013-2582

CVE.ORG link : CVE-2013-2582

JSON object : View

Products Affected

open-xchange

open-xchange_appsuite
open-xchange_server

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2013-2582", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-09-05T11:44:57.587", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0183.html", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitization of whitespace characters."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n CRLF en el servlet para redirigir en Open-Xchange AppSuite y Server anterior a v6.22.0 rev15, v6.22.1 anterior a rev17, v7.0.1 anterior a rev6, y v7.0.2 anterior a rev7 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de redirecci\u00f3n abierta mediante el aprovechamiento de saneamiento inadecuado de espacios en blanco."}], "lastModified": "2013-09-26T16:47:00.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F85EE0C-B7A0-455A-96F6-E4E6BA5D7216"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D9572CB-9A46-492E-BDCC-E01849EF0EC0"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "138461CD-9C27-40E5-B7A0-A37737B6E942"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "108BCEFD-3098-4919-9B0C-E80F6FA1C102"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_server:6.22.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58989467-7850-4D91-86D4-524EBE325869"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_server:6.22.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BED21777-8642-49AC-A99F-87ED9B21FE14"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_server:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FBAE267-EAB9-403A-8E1D-7C8EE68F0A36"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_server:7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5500DAF-78C2-4E30-AB1C-EF623C43956B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}