← Vulnerability feed

Vulnerability record · CVE-2016-6846 · published 29 March 2017

CVE-2016-6846: Open-xchange documentconverter-api cross-site scripting vulnerability

Open Xchange · Documentconverter Api

Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite frontend before 7.6.2-rev47, 7.8.0 before 7.8.0-rev30, and 7.8.2 before 7.8.2-rev8; Office Web before 7.6.2-rev16, 7.8.0 before 7.8.0-rev10, and 7.8.2 before 7.8.2-rev5; and Documentconverter-API before 7.8.2-rev5 allows remote attackers to inject arbitrary web script or HTML.

6.1 CVSS 3.0 Medium EPSS 1.2% · top 33.8% CWE-79 · Cross-site scripting
6.1CVSS 3.0 base score, v2 4.3
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
4Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite frontend before 7.6.2-rev47, 7.8.0 before 7.8.0-rev30, and 7.8.2 before 7.8.2-rev8; Office Web before 7.6.2-rev16, 7.8.0 before 7.8.0-rev10, and 7.8.2 before 7.8.2-rev5; and Documentconverter-API before 7.8.2-rev5 allows remote attackers to inject arbitrary web script or HTML.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_3520_7.8.0_2016-08-29.pdf Release NotesVendor Advisory
http://www.securityfocus.com/bid/93457 Third Party AdvisoryVDB Entry
https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3518_7.6.2_2016-08-29.pdf Release NotesVendor Advisory
https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3522_7.8.2_2016-08-29.pdf Release NotesVendor Advisory
http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_3520_7.8.0_2016-08-29.pdf Release NotesVendor Advisory
http://www.securityfocus.com/bid/93457 Third Party AdvisoryVDB Entry
https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3518_7.6.2_2016-08-29.pdf Release NotesVendor Advisory
https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3522_7.8.2_2016-08-29.pdf Release NotesVendor Advisory

Track CVE-2016-6846 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-26443Open-xchange appsuite backend sql injection vulnerabilityFull-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abus…EPSS 0.82%8.8CVE-2024-4367PDF.js missing type check allows arbitrary JavaScript executionPDF.js failed to perform a type check when handling fonts, allowing arbitrary JavaScript execution within the PDF.js context. This affects Firefox be…EPSS 71%analysed8.8CVE-2023-26436Open-xchange appsuite backend code injection vulnerabilityAttackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserializa…EPSS 1.3%7.5CVE-2023-26451Open-xchange appsuite backend vulnerabilityFunctions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes …EPSS 1.2%6.5CVE-2023-26428Open-xchange appsuite backend insecure direct object reference vulnerabilityAttackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other use…EPSS 0.98%5.4CVE-2023-26449Open-xchange appsuite frontend cross-site scripting vulnerabilityThe "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within …EPSS 0.73%5.4CVE-2023-26450Open-xchange appsuite frontend cross-site scripting vulnerabilityThe "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within…EPSS 0.73%5.4CVE-2023-26448Open-xchange appsuite frontend cross-site scripting vulnerabilityCustom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can …EPSS 0.66%

Source: NIST National Vulnerability Database (record CVE-2016-6846), CISA KEV, FIRST EPSS (scores of 2026-10-11). This page is refreshed as NVD updates the record.