CVE-2016-6846

Published: Mar 29, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite frontend before 7.6.2-rev47, 7.8.0 before 7.8.0-rev30, and 7.8.2 before 7.8.2-rev8; Office Web before 7.6.2-rev16, 7.8.0 before 7.8.0-rev10, and 7.8.2 before 7.8.2-rev5; and Documentconverter-API before 7.8.2-rev5 allows remote attackers to inject arbitrary web script or HTML.

Affected (10)

Products: Open Xchange: Documentconverter Api, Office Web, Open Xchange Appsuite Backend, Open Xchange Appsuite Frontend

Open Xchange

4 products

Documentconverter Api

Office Web

Open Xchange Appsuite Backend

Open Xchange Appsuite Frontend

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Open Xchange Documentconverter Api	Version 7.8.2 rev4
Open Xchange Office Web	Version 7.6.2 rev15
Open Xchange Office Web	Version 7.8.0 rev9
Open Xchange Office Web	Version 7.8.2 rev4
Open Xchange Open Xchange Appsuite Backend	Version 7.6.2 rev58
Open Xchange Open Xchange Appsuite Backend	Version 7.8.0 rev37
Open Xchange Open Xchange Appsuite Backend	Version 7.8.2 rev7
Open Xchange Open Xchange Appsuite Frontend	Version 7.6.2 rev46
Open Xchange Open Xchange Appsuite Frontend	Version 7.8.0 rev29
Open Xchange Open Xchange Appsuite Frontend	Version 7.8.2 rev7