VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jul 5, 2018· Updated Jun 17, 2026

CVE-2018-9998

CVE-2018-9998

Description

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks.

Affected products

91
  • Open-Xchange/Appsuiteinferred91 versions
    <7.6.3-rev37 || >=7.6.4,<7.8.2-rev40 || >=7.8.3,<7.8.3-rev48 || >=7.8.4,<7.8.4-rev28+ 90 more
    • (no CPE)range: <7.6.3-rev37 || >=7.6.4,<7.8.2-rev40 || >=7.8.3,<7.8.3-rev48 || >=7.8.4,<7.8.4-rev28
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*range: <=7.6.3
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev14:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev15:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev16:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev17:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev18:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev20:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev22:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev23:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev24:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev25:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev26:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev28:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev29:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev30:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev31:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev32:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev33:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev35:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.3:rev36:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.0:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.2:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev10:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev11:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev12:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev13:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev14:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev15:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev16:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev17:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev18:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev19:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev20:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev21:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev22:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev23:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev24:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev25:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev26:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev27:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev28:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev29:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev30:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev31:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev32:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev33:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev34:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev35:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev36:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev38:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev39:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev40:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev41:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev42:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev43:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev44:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev45:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev46:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev47:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev5:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev6:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev8:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.3:rev9:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev10:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev11:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev13:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev14:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev15:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev16:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev17:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev18:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev19:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev20:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev21:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev22:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev23:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev24:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev25:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev26:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev27:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev3:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev4:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev5:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev6:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev7:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev8:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.8.4:rev9:*:*:*:*:*:*
    • (no CPE)range: <7.6.3-rev37, <7.8.2-rev40, <7.8.3-rev48, <7.8.4-rev28

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.