CVE-2018-5754

Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the clipboard.

Published: Jun 16, 2018
Updated: Apr 13, 2023
CVE: CVE-2018-5754
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.4
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
open-xchange / open-xchange_appsuite	7.8.4-rev8	7.8.4-rev8.x
open-xchange / open-xchange_appsuite	7.8.4-rev7	7.8.4-rev7.x
open-xchange / open-xchange_appsuite	7.8.4-rev6	7.8.4-rev6.x
open-xchange / open-xchange_appsuite	7.8.4-rev5	7.8.4-rev5.x
open-xchange / open-xchange_appsuite	7.8.4-rev4	7.8.4-rev4.x
open-xchange / open-xchange_appsuite	7.8.4-rev3	7.8.4-rev3.x
open-xchange / open-xchange_appsuite	7.8.4	7.8.4.x
open-xchange / open-xchange_appsuite	7.8.3-rev11	7.8.3-rev11.x
open-xchange / open-xchange_appsuite	7.8.3-rev9	7.8.3-rev9.x
open-xchange / open-xchange_appsuite	7.8.3-rev8	7.8.3-rev8.x
open-xchange / open-xchange_appsuite	7.8.3-rev6	7.8.3-rev6.x
open-xchange / open-xchange_appsuite	7.8.3-rev5	7.8.3-rev5.x
open-xchange / open-xchange_appsuite	-	7.8.3.x
open-xchange / open-xchange_appsuite	7.8.3-rev10	7.8.3-rev10.x

Vulnerability Database

CVE-2018-5754