What’s Vulnerable › Vulnerabilities

CVE-2016-6189

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-02-17 · updated 2026-06-17
• Weakness: CWE-184

Description

Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.

Affected products

• Alinto SOGo: before 2.3.12; from 3.0.0 before 3.1.1 — fixed in 2.3.12, 3.1.1

How to fix

Upgrade to a fixed version: Alinto SOGo 2.3.12, 3.1.1. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2016/07/09/3
• https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225
• https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d
• https://sogo.nu/bugs/view.php?id=3695
• http://www.openwall.com/lists/oss-security/2016/07/09/3
• https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225
• https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d
• https://sogo.nu/bugs/view.php?id=3695

Get alerted when CVE-2016-6189 or the next vulnerability affects your stack