Path Traversal in Open-Xchange Appsuite
CVE-2014-5236
Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted (1) OLE Object or (2) image in an OpenDocument text file.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.038 (89.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 89.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.038 · newest: 0.038 · change: 0.000
Affected products
- Open-Xchange Appsuite — versions 7.4.2, 7.6.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html (VDB Entry, Third Party Advisory)
- www.securityfocus.com/archive/1/archive/1/533443/100/0/threaded (VDB Entry, Third Party Advisory)
- software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_20… (Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2014-5236?
- CVE-2014-5236 is a high-severity vulnerability in Open-Xchange Appsuite, classified under Path Traversal. CVSS score: 7.5/10. Published 2020-01-31.
- How severe is CVE-2014-5236?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2014-5236 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.