← Back

CVE-2013-6241

nvd nist
Published: Dec 27, 2014Modified: May 6, 2026

JSON object

Loading...
4.0
Vector
AV:N/AC:L/Au:S/C:P/I:N/A:N
Exploitability: 8.0 / Impact: 2.9
Source: NVD

Description

The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, does not properly construct a SQL statement for next-year birthdays, which allows remote authenticated users to obtain sensitive birthday, displayname, firstname, and surname information via a birthdays action to api/contacts, aka bug 29315.

Affected (4)

Open Xchange
1 product
Open Xchange Appsuite
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Open Xchange
Open Xchange Appsuite
Version 7.2.0
Open Xchange Appsuite
Version 7.2.1
Open Xchange Appsuite
Version 7.2.2
Open Xchange Appsuite
Version 7.4.0

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

Source: cve@mitre.org
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.