CVE-2013-1648

Published: Sep 5, 2013Modified: Apr 29, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allows remote authenticated users to trigger arbitrary outbound TCP traffic via a crafted Source field, as demonstrated by (1) an ftp: URL, (2) a gopher: URL, or (3) an http://127.0.0.1/ URL, related to a "Server-side request forging (SSRF)" issue.

Affected (3)

Products: Open Xchange: Open Xchange Server

1 product

Open Xchange Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Open Xchange Open Xchange Server	Version 6.20.7
Open Xchange Open Xchange Server	Version 6.22.0
Open Xchange Open Xchange Server	Version 6.22.1

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html

Source: cve@mitre.org

Exploit

http://archives.neohapsis.com/archives/bugtraq/2013-03/0075.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.