CVE-2015-8542

An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the "id" and "cid" parameter to specify the current user by its user- and context-ID. The "auth" parameter contains a hashed password string which gets created by the client by asking the user to enter his or her OX Guard password. This parameter is used as single point of authentication when accessing PGP Private Keys. In case a user has set the same password as another user, it is possible to download another user's PGP Private Key by iterating the "id" and "cid" parameters. This kind of attack would also be able by brute-forcing login credentials, but since the "id" and "cid" parameters are sequential they are much easier to predict than a user's login name. At the same time, there are some obvious insecure standard passwords that are widely used. A attacker could send the hashed representation of typically weak passwords and randomly fetch Private Key of matching accounts. The attack can be executed by both internal users and "guests" which use the external mail reader.

• CWE-320

• http://packetstormsecurity.com/files/136069/Open-Xchange-Guard-2.2.0-2.0-Private-Key-Disclosure.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/537678/100/0/threaded
• http://www.securitytracker.com/id/1035174Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/136069/Open-Xchange-Guard-2.2.0-2.0-Private-Key-Disclosure.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/537678/100/0/threaded
• http://www.securitytracker.com/id/1035174Third Party Advisory, VDB Entry

Published

Dec 15, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8535MITRE is populating this ID because it was assigned prior to…7.8
• CVE-2015-8536MITRE is populating this ID because it was assigned prior to…8.8
• CVE-2015-8537app/views/journals/index.builder in Redmine before 2.6.9, 3.…
• CVE-2015-8538dwarf_leb.c in libdwarf allows attackers to cause a denial o…6.5
• CVE-2015-8539The KEYS subsystem in the Linux kernel before 4.4 allows loc…7.8
• CVE-2015-8540Integer underflow in the png_check_keyword function in pngwu…
• CVE-2015-8543The networking implementation in the Linux kernel through 4.…7
• CVE-2015-8544NetApp SnapDrive for Windows before 7.0.2P4, 7.0.3, and 7.1 …
• CVE-2015-8546An issue was discovered on Samsung mobile devices with softw…9.8
• CVE-2015-8547The CoreUserInputHandler::doMode function in core/coreuserin…
• CVE-2015-8548Multiple unspecified vulnerabilities in Google V8 before 4.7…
• CVE-2015-8549XML external entity (XXE) vulnerability in PyAMF before 0.8.…7.1