CVE-2014-5236: open-xchange appsuite

csirt@kutim:~/threat-intel/cve/CVE-2014-5236

CVSS 7.5 · High EPSS 3,8%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada open-xchange appsuite. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted (1) OLE Object or (2) image in an OpenDocument text file.

Rincian

Terbit di NVD: 31 Januari 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 3,8% peluang dieksploitasi; lebih tinggi dari 89,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
open-xchange	open-xchange appsuite	Semua versi hingga 7.4.1
open-xchange	open-xchange appsuite	Versi 7.4.2
open-xchange	open-xchange appsuite	Versi 7.4.2 revision1
open-xchange	open-xchange appsuite	Versi 7.4.2 revision10
open-xchange	open-xchange appsuite	Versi 7.4.2 revision2
open-xchange	open-xchange appsuite	Versi 7.4.2 revision3
open-xchange	open-xchange appsuite	Versi 7.4.2 revision4
open-xchange	open-xchange appsuite	Versi 7.4.2 revision5
open-xchange	open-xchange appsuite	Versi 7.4.2 revision6
open-xchange	open-xchange appsuite	Versi 7.4.2 revision7
open-xchange	open-xchange appsuite	Versi 7.4.2 revision8
open-xchange	open-xchange appsuite	Versi 7.4.2 revision9
open-xchange	open-xchange appsuite	Versi 7.6.0
open-xchange	open-xchange appsuite	Versi 7.6.0 revision1
open-xchange	open-xchange appsuite	Versi 7.6.0 revision2
open-xchange	open-xchange appsuite	Versi 7.6.0 revision3
open-xchange	open-xchange appsuite	Versi 7.6.0 revision4
open-xchange	open-xchange appsuite	Versi 7.6.0 revision5
open-xchange	open-xchange appsuite	Versi 7.6.0 revision6
open-xchange	open-xchange appsuite	Versi 7.6.0 revision7
open-xchange	open-xchange appsuite	Versi 7.6.0 revision8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf release notes · advisory vendor
http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html advisory pihak ketiga · vdb entry
http://www.securityfocus.com/archive/1/archive/1/533443/100/0/threaded advisory pihak ketiga · vdb entry

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.