Open Xchange Server

Vendor:

First CVE: Sep 5, 2013 · Active for 12 years

13

Total CVEs

More Total CVEs than 91% of tracked products

4.3

Avg CVEs / Year

Higher CVE frequency than 86% of tracked products

4.3

Avg CVSS

Higher Avg CVSS than 4% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Open Xchange Server over time

Volume of CVEsAvg CVSS Base Score

First CVE

Sep 5, 2013

12 years ago

Most Recent CVE

Jun 8, 2017

3,335 days ago

CVE Severity & Scoring

Open Xchange Server13 CVEs

23%

77%

All CVEs352,719 CVEs

45%

40%

11%

LowMedium

Attack Vector

Local0 (0.0%)

Network1 (7.7%)

Unknown12 (92.3%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low1 (7.7%)

High0 (0.0%)

Unknown12 (92.3%)

User Interaction

None0 (0.0%)

Unknown12 (92.3%)

Required1 (7.7%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None1 (7.7%)

Unknown12 (92.3%)

Top CVEs

Signals from CVEs in this product scope (13 CVEs).

13 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2013-1647MEDIUM Multiple CRLF injection vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary HTTP hea	Sep 5, 2013	5.0	25	NO	YES
CVE-2013-1651MEDIUM OXUpdater in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not verify X.509 certificates from SSL servers, which allows man-in-the-midd	Sep 5, 2013	5.8	24	NO	YES
CVE-2013-1645MEDIUM Directory traversal vulnerability in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allows remote authenticated users to read arbitrary files	Sep 5, 2013	4.0	24	NO	YES
CVE-2013-1649MEDIUM Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses the crypt and SHA-1 algorithms for password hashing, which makes it easier for context-de	Sep 5, 2013	4.3	21	NO	YES
CVE-2013-1648LOW The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allo	Sep 5, 2013	3.5	21	NO	YES
CVE-2013-1646MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitr	Sep 5, 2013	4.3	21	NO	YES
CVE-2013-2582MEDIUM CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows r	Sep 5, 2013	5.0	18	NO	NO
CVE-2015-1588MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21.	Jun 8, 2017	6.1	17	NO	NO
CVE-2013-2583MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev16, 6.22.0 before rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2	Sep 5, 2013	4.3	17	NO	NO
CVE-2013-1650LOW Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses weak permissions (group "other" readable) under opt/open-xchange/etc/, which allows local	Sep 5, 2013	2.1	17	NO	YES

View all 13 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (13 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

7 CVEs

53.8% of CVEs· 93rd percentile

Social Chatter

Signals from CVEs in this product scope (13 CVEs).

Media Mentions

Signals from CVEs in this product scope (13 CVEs).

Top CNAs Publishing CVEs For Open Xchange Server

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
7.2.0	2	3.9	0.9%	0
7.0.2	4	4.3	0.9%	0
7.0.1	4	4.3	0.9%	0
6.22.13	1	6.1	1.5%	0
6.22.12	1	6.1	1.5%	0
6.22.1	11	4.2	1.3%	7
6.22.0	11	4.2	1.3%	7
6.20.7	9	4.2	1.4%	7
6.0	1	6.1	1.5%	0