Read the docs
TI-2014-04275 Aliases CVE-2014-5238GHSA-ccpx-2wj9-vw2w

XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11…

Priority LOW 38CWE-611Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document.

Why it matters now

EPSS 0.01931 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*up to 7.4.1VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:*:*:*:*:*:*:*7.4.2VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision1:*:*:*:*:*:*7.4.2 revision1VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision10:*:*:*:*:*:*7.4.2 revision10VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision2:*:*:*:*:*:*7.4.2 revision2VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision3:*:*:*:*:*:*7.4.2 revision3VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision4:*:*:*:*:*:*7.4.2 revision4VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision5:*:*:*:*:*:*7.4.2 revision5VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision6:*:*:*:*:*:*7.4.2 revision6VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision7:*:*:*:*:*:*7.4.2 revision7VulnerableOpen-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:* Versions up to 7.4.1 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision1:*:*:*:*:*:* Versions 7.4.2 revision1 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision10:*:*:*:*:*:* Versions 7.4.2 revision10 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision2:*:*:*:*:*:* Versions 7.4.2 revision2 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision3:*:*:*:*:*:* Versions 7.4.2 revision3 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision4:*:*:*:*:*:* Versions 7.4.2 revision4 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision5:*:*:*:*:*:* Versions 7.4.2 revision5 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision6:*:*:*:*:*:* Versions 7.4.2 revision6 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision7:*:*:*:*:*:* Versions 7.4.2 revision7 Vulnerable ·Open-Xchange GmbH
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision8:*:*:*:*:*:*7.4.2 revision8VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision9:*:*:*:*:*:*7.4.2 revision9VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:*:*:*:*:*:*:*7.6.0VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision1:*:*:*:*:*:*7.6.0 revision1VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision2:*:*:*:*:*:*7.6.0 revision2VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision3:*:*:*:*:*:*7.6.0 revision3VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision4:*:*:*:*:*:*7.6.0 revision4VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision5:*:*:*:*:*:*7.6.0 revision5VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision6:*:*:*:*:*:*7.6.0 revision6VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision7:*:*:*:*:*:*7.6.0 revision7VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision8:*:*:*:*:*:*7.6.0 revision8VulnerableOpen-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision8:*:*:*:*:*:* Versions 7.4.2 revision8 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.2:revision9:*:*:*:*:*:* Versions 7.4.2 revision9 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:*:*:*:*:*:*:* Versions 7.6.0 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision1:*:*:*:*:*:* Versions 7.6.0 revision1 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision2:*:*:*:*:*:* Versions 7.6.0 revision2 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision3:*:*:*:*:*:* Versions 7.6.0 revision3 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision4:*:*:*:*:*:* Versions 7.6.0 revision4 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision5:*:*:*:*:*:* Versions 7.6.0 revision5 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision6:*:*:*:*:*:* Versions 7.6.0 revision6 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision7:*:*:*:*:*:* Versions 7.6.0 revision7 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.6.0:revision8:*:*:*:*:*:* Versions 7.6.0 revision8 Vulnerable ·Open-Xchange GmbH

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-5238
  2. 2026-10-03 Alias added: GHSA-ccpx-2wj9-vw2w

References

Advisory 2

  • TI-2022-17394 OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only… CVSS 3.1MEDIUM 5.3
  • TI-2022-17393 OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request… CVSS 3.1MEDIUM 5.3
  • TI-2022-17392 OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location… CVSS 3.1MEDIUM 5.3
  • TI-2022-17391 OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help… CVSS 3.1MEDIUM 6.1
  • TI-2022-17390 OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name. CVSS 3.1MEDIUM 6.1
  • TI-2022-17389 OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages. CVSS 3.1MEDIUM 6.1
See all 156 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences