Unscored severity · published Dec 1, 2014
CVE-2014-5237
Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded image in a Text document, which is not properly handled by the image preview.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
App Suite · Open-xchange
7.4.2; 7.4.2; 7.4.2; 7.4.2; 7.6.0; 7.6.0; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5237
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5237
Third Party Advisory
http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html
Vendor Advisory
http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf
Third Party Advisory
http://www.securityfocus.com/archive/1/533443/100/0/threaded
More from App Suite
6.5
CVE-2024-23188
Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session
5.4
CVE-2022-23099
OX App Suite through 7.10.6 allows XSS by forcing block-wise read