Medium severity4.3NVD Advisory· Published Jun 16, 2018· Updated Jun 17, 2026

CVE-2018-5756

Description

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a delete action to api/tasks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Open-Xchange/Appsuitellm-create80 versions
< 7.8.4-rev22+ 79 more
- (no CPE)range: < 7.8.4-rev22
- (no CPE)range: <7.6.3-rev36 || >=7.8.0,<7.8.2-rev39 || >=7.8.3,<7.8.3-rev44 || >=7.8.4,<7.8.4-rev22
- cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*range: <=7.6.3
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev14:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev15:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev16:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev17:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev18:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev20:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev22:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev23:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev24:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev25:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev26:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev28:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev29:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev30:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev31:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev32:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev33:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev35:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev10:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev11:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev12:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev13:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev14:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev15:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev16:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev17:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev18:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev19:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev20:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev21:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev22:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev23:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev24:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev25:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev26:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev27:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev28:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev29:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev30:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev31:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev32:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev33:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev34:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev35:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev36:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev38:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev39:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev40:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev41:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev42:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev43:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev5:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev6:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev8:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev9:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev10:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev11:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev13:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev14:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev15:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev16:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev17:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev18:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev19:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev20:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev21:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev3:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev4:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev5:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev6:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev7:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev8:*:*:*:*:*:*
- cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev9:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.htmlnvdExploitThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2018/Jun/23nvdExploitMailing ListThird Party Advisory
www.exploit-db.com/exploits/44881/nvdExploitThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.004
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000