medium5.8Public exploit code
CVE-2013-1651
OXUpdater in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not verify X.509 certificates from SSL servers, which a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Open-Xchange Server 6 - Multiple Vulnerabilities2013-03-15 · webapps · java
Impact
OXUpdater in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof update servers and install arbitrary software via a crafted certificate.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Open-Xchange | Open-Xchange Server | Versions 6.20.7, 6.22.0, 6.22.1 |