Test ID:	1.3.6.1.4.1.25623.1.0.803182
Category:	Web application abuses
Title:	Open-Xchange Server Multiple Vulnerabilities (Mar 2013) - Active Check
Summary:	Open-Xchange Server is prone to multiple vulnerabilities.
Description:	Summary: Open-Xchange Server is prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - Input passed via arbitrary GET parameters to /servlet/TestServlet is not properly sanitized before being returned to the user. - Input related to the 'Source' field when creating subscriptions is not properly sanitized before being used. This can be exploited to perform arbitrary HTTP GET requests to remote and local servers. - The OXUpdater component does not properly validate the SSL certificate of an update server. This can be exploited to spoof update packages via a MitM (Man-in-the-Middle) attack. - The application creates the /opt/open-exchange/etc directory with insecure world-readable permissions. This can be exploited to disclose certain sensitive information. - Input passed via the 'location' GET parameter to /ajax/redirect is not properly sanitized before being used to construct HTTP response headers. - Certain input related to RSS feed contents is not properly sanitized before being used. This can be exploited to insert arbitrary HTML and script code. Affected Software/OS: Open-Xchange Server versions prior to 6.20.7-rev14, 6.22.0-rev13 and 6.22.1-rev14. Solution: Update to versions 6.20.7-rev14, 6.22.0-rev13, 6.22.1-rev14 or later. CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1646 Bugtraq: 20130313 Open-Xchange Security Advisory 2013-03-13 (Google Search) http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html Common Vulnerability Exposure (CVE) ID: CVE-2013-1647 Common Vulnerability Exposure (CVE) ID: CVE-2013-1648 Common Vulnerability Exposure (CVE) ID: CVE-2013-1650 Common Vulnerability Exposure (CVE) ID: CVE-2013-1651
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.