CVSS 3.0
7.4 highCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:NCVE-2016-3174
High (7.4) in open-xchange open-xchange appsuite. EPSS 1.0% chance of exploitation in the next 30 days.
An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The "defer" servlet offers to redirect a client to a specified URL. Since some checks were missing, arbitrary URLs could be provided as redirection target. Users can be tricked to follow a link to a trustworthy domain but end up at an unexpected service later on. This vulnerability can be used to prepare and enhance phishing attacks.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
- CWE
- CWE-601
- Published
- Modified
- Record from
- the NVD, synced
Affected
- open-xchange:open-xchange_appsuite
References
- http://packetstormsecurity.com/files/137187/Open-Xchange-OX-AppSuite-7.8.0-XSS-Open-Redirect.html
- http://www.securityfocus.com/archive/1/538481/100/0/threaded
- http://packetstormsecurity.com/files/137187/Open-Xchange-OX-AppSuite-7.8.0-XSS-Open-Redirect.html
- http://www.securityfocus.com/archive/1/538481/100/0/threaded