CVE-2016-2840

CVE-2016-2840 describes a cross-site scripting (XSS) vulnerability in Open-Xchange Server 6 and OX AppSuite versions prior to 7.8.0-rev26. An unauthenticated attacker can inject script code into the "session" parameter of file-download requests, which is then reflected on the subsequent status page. This allows for the execution of malicious scripts within the context of a trusted domain, potentially leading to social engineering attacks, cookie theft, or redirection to malicious hosts. The vulnerability has a CVSS v3.0 score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low impact to confidentiality and integrity. While no specific OX App Suite data can be manipulated, the unauthenticated nature of the exploit makes it a significant risk. There is no evidence of active exploitation (KEV: No), nor are there publicly available Metasploit, Nuclei, or ExploitDB modules. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness and attention.