CVE-2014-8993

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-01-07 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type.

Affected products

Open-Xchange Appsuite: through 7.4.2; 7.6.0, 7.6.1

References

http://packetstormsecurity.com/files/129811/Open-Xchange-Server-6-OX-AppSuite-7.6.1-Cross-Site-Scripting.html
http://secunia.com/advisories/62031
http://www.securityfocus.com/archive/1/534383/100/0/threaded
http://www.securitytracker.com/id/1031488
http://packetstormsecurity.com/files/129811/Open-Xchange-Server-6-OX-AppSuite-7.6.1-Cross-Site-Scripting.html
http://secunia.com/advisories/62031
http://www.securityfocus.com/archive/1/534383/100/0/threaded
http://www.securitytracker.com/id/1031488

Get alerted when CVE-2014-8993 or the next vulnerability affects your stack