1. Home
  2. CVE Database
  3. CVE-2013-1648
LOW · 3.5

CVE-2013-1648

The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allows remote authentica...

Vulnerability Description

The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allows remote authenticated users to trigger arbitrary outbound TCP traffic via a crafted Source field, as demonstrated by (1) an ftp: URL, (2) a gopher: URL, or (3) an http://127.0.0.1/ URL, related to a "Server-side request forging (SSRF)" issue.

CVSS Score

3.5

LOW

AV:N/AC:M/Au:S/C:N/I:P/A:N
Confidentiality
NONE
Integrity
PARTIAL
Availability
NONE

Affected Products

VendorProductVersions
Open-XchangeOpen-Xchange Server6.20.7

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2013-1648?

CVE-2013-1648 is a vulnerability with a CVSS score of 3.5 (LOW). The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allows remote authentica...

How severe is CVE-2013-1648?

CVE-2013-1648 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-1648?

Check the references section above for vendor advisories and patch information. Affected products include: Open-Xchange Open-Xchange Server.