CVE-2013-1651

CVE-2013-1651 describes a critical vulnerability in OXUpdater, a component of Open-Xchange Server versions prior to 6.20.7 rev14, 6.22.0 rev13, and 6.22.1 rev14. The flaw stems from the updater's failure to properly validate X.509 certificates from SSL servers, enabling man-in-the-middle attackers to impersonate legitimate update servers. This allows attackers to install arbitrary software on affected systems by presenting a crafted certificate. The vulnerability carries a CVSS score of 5.8, indicating a medium severity. It can be exploited remotely over the network with medium attack complexity, potentially leading to partial compromise of confidentiality and integrity. The FAUCET Risk Score is 79/100, highlighting its significant risk. While there is no evidence of active exploitation (not in KEV), exploit code for multiple vulnerabilities in Open-Xchange Server 6, including this one, is available on ExploitDB (EDB-24791). Despite this, there is no recorded community discussion or media coverage, suggesting low public awareness of this specific CVE.