Server-side request forgery (SSRF) vulnerability in the documentconverter component in…
Priority LOW 25Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded image in a Text document, which is not properly handled by the image preview.
Why it matters now
EPSS 0.02357 83rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:open-xchange:app_suite:7.4.2:rev6:*:*:*:*:*:* | 7.4.2 rev6 | Vulnerable | Open-Xchange GmbH |
| cpe:2.3:a:open-xchange:app_suite:7.4.2:rev7:*:*:*:*:*:* | 7.4.2 rev7 | Vulnerable | Open-Xchange GmbH |
| cpe:2.3:a:open-xchange:app_suite:7.4.2:rev8:*:*:*:*:*:* | 7.4.2 rev8 | Vulnerable | Open-Xchange GmbH |
| cpe:2.3:a:open-xchange:app_suite:7.4.2:rev9:*:*:*:*:*:* | 7.4.2 rev9 | Vulnerable | Open-Xchange GmbH |
| cpe:2.3:a:open-xchange:app_suite:7.6.0:rev6:*:*:*:*:*:* | 7.6.0 rev6 | Vulnerable | Open-Xchange GmbH |
| cpe:2.3:a:open-xchange:app_suite:7.6.0:rev7:*:*:*:*:*:* | 7.6.0 rev7 | Vulnerable | Open-Xchange GmbH |
| cpe:2.3:a:open-xchange:app_suite:7.6.0:rev8:*:*:*:*:*:* | 7.6.0 rev8 | Vulnerable | Open-Xchange GmbH |
| cpe:2.3:a:open-xchange:app_suite:7.6.0:rev9:*:*:*:*:*:* | 7.6.0 rev9 | Vulnerable | Open-Xchange GmbH |
- cpe:2.3:a:open-xchange:app_suite:7.4.2:rev6:*:*:*:*:*:* Versions 7.4.2 rev6 Vulnerable ·Open-Xchange GmbH
- cpe:2.3:a:open-xchange:app_suite:7.4.2:rev7:*:*:*:*:*:* Versions 7.4.2 rev7 Vulnerable ·Open-Xchange GmbH
- cpe:2.3:a:open-xchange:app_suite:7.4.2:rev8:*:*:*:*:*:* Versions 7.4.2 rev8 Vulnerable ·Open-Xchange GmbH
- cpe:2.3:a:open-xchange:app_suite:7.4.2:rev9:*:*:*:*:*:* Versions 7.4.2 rev9 Vulnerable ·Open-Xchange GmbH
- cpe:2.3:a:open-xchange:app_suite:7.6.0:rev6:*:*:*:*:*:* Versions 7.6.0 rev6 Vulnerable ·Open-Xchange GmbH
- cpe:2.3:a:open-xchange:app_suite:7.6.0:rev7:*:*:*:*:*:* Versions 7.6.0 rev7 Vulnerable ·Open-Xchange GmbH
- cpe:2.3:a:open-xchange:app_suite:7.6.0:rev8:*:*:*:*:*:* Versions 7.6.0 rev8 Vulnerable ·Open-Xchange GmbH
- cpe:2.3:a:open-xchange:app_suite:7.6.0:rev9:*:*:*:*:*:* Versions 7.6.0 rev9 Vulnerable ·Open-Xchange GmbH
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-5237
- 2026-10-03 Alias added: GHSA-9c4c-qp3h-qxm5
References
More Open-Xchange GmbH App Suite vulnerabilities
- TI-2022-07268 OX App Suite through 7.10.6 allows XSS by forcing block-wise read. CVSS 3.1MEDIUM 5.4
Sources
- CVE-2014-5237 · CVE Program
- CVE-2014-5237 · NVD
- FIRST EPSS
- GHSA-9c4c-qp3h-qxm5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences