CVE-2013-6997

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-01-09 · updated 2026-06-17
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing "crafted hyperlinks with script URL handlers."

Affected products

Open-Xchange Appsuite: through 7.4.0; 6.20.7, 6.22.0, 6.22.1, 7.0.1, 7.0.2, 7.2.0 (+2)

References

http://software.open-xchange.com/OX6/doc/Release_Notes_for_Public_Patch_Release_1766_7.4.0_Rev21_2013_12_13.pdf
http://www.osvdb.org/101714
http://www.osvdb.org/101715
http://www.securityfocus.com/archive/1/530681/100/0/threaded
http://www.securityfocus.com/bid/64676
http://www.securitytracker.com/id/1029554
https://exchange.xforce.ibmcloud.com/vulnerabilities/90113
http://software.open-xchange.com/OX6/doc/Release_Notes_for_Public_Patch_Release_1766_7.4.0_Rev21_2013_12_13.pdf
http://www.osvdb.org/101714
http://www.osvdb.org/101715
http://www.securityfocus.com/archive/1/530681/100/0/threaded
http://www.securityfocus.com/bid/64676

Get alerted when CVE-2013-6997 or the next vulnerability affects your stack