vendor:
OX App Suite
by:
Michael Reizelman
4.3
CVSS
MEDIUM
Improper Privilege Management
269, 80
CWE
Product Name: OX App Suite
Affected Version From: 7.8.4 and earlier
Affected Version To: 7.6.3-rev36, 7.8.2-rev39, 7.8.3-rev44, 7.8.4-rev22
Patch Exists: YES
Related CWE: CVE-2018-5754, CVE-2018-5756
CPE: ox_app_suite
Metasploit:
https://www.rapid7.com/db/vulnerabilities/alpine-linux-cve-2018-19965/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2018-19965/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2018-19965/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2018-10471/, https://www.rapid7.com/db/vulnerabilities/alpine-linux-cve-2018-10471/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2018-10471/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2018-10471/, https://www.rapid7.com/db/vulnerabilities/redhat_linux-rhsa-2018-1129/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cesa-2018-0512/, https://www.rapid7.com/db/vulnerabilities/redhat_linux-rhsa-2018-0496/, https://www.rapid7.com/db/vulnerabilities/redhat_linux-rhsa-2018-0512/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-elsa-2018-4021/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-elsa-2018-4012/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-elsa-2018-4011/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2017-5754/, https://www.rapid7.com/db/vulnerabilities/amazon_linux-cve-2017-5754/
Other Scripts:
https://www.infosecmatter.com/nessus-plugin-library/?id=105552, https://www.infosecmatter.com/nessus-plugin-library/?id=106297, https://www.infosecmatter.com/nessus-plugin-library/?id=118304, https://www.infosecmatter.com/nessus-plugin-library/?id=106797, https://www.infosecmatter.com/nessus-plugin-library/?id=109001, https://www.infosecmatter.com/nessus-plugin-library/?id=108290, https://www.infosecmatter.com/nessus-plugin-library/?id=107129, https://www.infosecmatter.com/nessus-plugin-library/?id=123180, https://www.infosecmatter.com/nessus-plugin-library/?id=106864, https://www.infosecmatter.com/nessus-plugin-library/?id=132101, https://www.infosecmatter.com/nessus-plugin-library/?id=140019, https://www.infosecmatter.com/nessus-plugin-library/?id=138415, https://www.infosecmatter.com/nessus-plugin-library/?id=138854, https://www.infosecmatter.com/nessus-plugin-library/?id=138643, https://www.infosecmatter.com/nessus-plugin-library/?id=137516, https://www.infosecmatter.com/nessus-plugin-library/?id=139551
Platforms Tested: None
2018
OX App Suite Improper Privilege Management Vulnerability
Permission checks for tasks were incomplete with regards to folder-to-object association. Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Mitigation:
We no longer offer "Open in Browser" for IE based browsers. Microsoft Edge is not affected by this change. We added additional permission checks to the task-folder association.
