CVE-2016-6190
SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated…
Does this matter?
Lower severity and a low EPSS score (1.24%). Track it; it rarely justifies an emergency change on its own.
Description
SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.
- CVSS 3.0
- 4.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.24% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- inverse-inc/sogo
- Source
- cve@mitre.org
References
- http://www.openwall.com/lists/oss-security/2016/07/09/3Mailing List, VDB Entry
- https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225Patch
- https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343dPatch
- https://sogo.nu/bugs/view.php?id=3696Vendor Advisory
- http://www.openwall.com/lists/oss-security/2016/07/09/3Mailing List, VDB Entry
- https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225Patch
- https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343dPatch
- https://sogo.nu/bugs/view.php?id=3696Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.