CVE-2014-5238: open-xchange appsuite

csirt@kutim:~/threat-intel/cve/CVE-2014-5238

CVSS 7.8 · High EPSS 1,9%

Kerentanan Improper Restriction of XML External Entity Reference pada open-xchange appsuite. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document.

Rincian

Terbit di NVD: 14 Januari 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-611: Improper Restriction of XML External Entity Reference
EPSS (30 hari): 1,9% peluang dieksploitasi; lebih tinggi dari 79,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
open-xchange	open-xchange appsuite	Semua versi hingga 7.4.1
open-xchange	open-xchange appsuite	Versi 7.4.2
open-xchange	open-xchange appsuite	Versi 7.4.2 revision1
open-xchange	open-xchange appsuite	Versi 7.4.2 revision10
open-xchange	open-xchange appsuite	Versi 7.4.2 revision2
open-xchange	open-xchange appsuite	Versi 7.4.2 revision3
open-xchange	open-xchange appsuite	Versi 7.4.2 revision4
open-xchange	open-xchange appsuite	Versi 7.4.2 revision5
open-xchange	open-xchange appsuite	Versi 7.4.2 revision6
open-xchange	open-xchange appsuite	Versi 7.4.2 revision7
open-xchange	open-xchange appsuite	Versi 7.4.2 revision8
open-xchange	open-xchange appsuite	Versi 7.4.2 revision9
open-xchange	open-xchange appsuite	Versi 7.6.0
open-xchange	open-xchange appsuite	Versi 7.6.0 revision1
open-xchange	open-xchange appsuite	Versi 7.6.0 revision2
open-xchange	open-xchange appsuite	Versi 7.6.0 revision3
open-xchange	open-xchange appsuite	Versi 7.6.0 revision4
open-xchange	open-xchange appsuite	Versi 7.6.0 revision5
open-xchange	open-xchange appsuite	Versi 7.6.0 revision6
open-xchange	open-xchange appsuite	Versi 7.6.0 revision7
open-xchange	open-xchange appsuite	Versi 7.6.0 revision8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf release notes · advisory vendor
http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html advisory pihak ketiga · vdb entry
http://www.securityfocus.com/archive/1/archive/1/533443/100/0/threaded advisory pihak ketiga · vdb entry

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.