Medium severity5.5NVD Advisory· Published Dec 15, 2016· Updated Jun 17, 2026
CVE-2016-6848
CVE-2016-6848
Description
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client ("Reflected File Download"). Malicious platform specific (e.g. Microsoft Windows) batch file can be created via a trusted domain without authentication that, if executed by the user, may lead to local code execution.
Affected products
2cpe:2.3:a:open-xchange:open-xchange_appsuite:*:rev4:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:open-xchange:open-xchange_appsuite:*:rev4:*:*:*:*:*:*range: <=7.8.2
- (no CPE)range: <7.8.2-rev8
Patches
Vulnerability mechanics
References
2- www.securityfocus.com/bid/93460nvdThird Party AdvisoryVDB Entry
- software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3522_7.8.2_2016-08-29.pdfnvdRelease NotesVendor Advisory
News mentions
0No linked articles in our index yet.