CVE-2016-6189 Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
MediumCVSS 4.3
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sogo(Debian:12) | < 3.2.4-0.2 | 3.2.4-0.2 |
| debian/sogo(Debian:13) | < 3.2.4-0.2 | 3.2.4-0.2 |
| alinto sogo | < 2.3.12 | 2.3.12 |
| alinto sogo | >= 3.0.0, < 3.1.1 | 3.1.1 |
| ubuntu/sogo(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/sogo(Ubuntu:26.10) | All versions | No fix listed |
References
- Debian Security Tracker CVE-2016-6189 vendor-advisory
- [oss-security] 20160709 Re: CVE request: several SOGo issues (DOS, XSS, information leakage) mailing-list vdb-entry
- github.com patch
- github.com patch
- sogo.nu exploit vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org