CVE-2018-5754

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-06-16 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the clipboard.

Affected products

Open-Xchange Appsuite: through 7.8.3; 7.8.3-rev10, 7.8.3-rev11, 7.8.3-rev5, 7.8.3-rev6, 7.8.3-rev8, 7.8.3-rev9 (+7)

References

http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html
http://seclists.org/fulldisclosure/2018/Jun/23
https://www.exploit-db.com/exploits/44881/
http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html
http://seclists.org/fulldisclosure/2018/Jun/23
https://www.exploit-db.com/exploits/44881/

Get alerted when CVE-2018-5754 or the next vulnerability affects your stack