CVE-2016-3173

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file (e.g. an image) which gets displayed at the portal application. Using script code at the file name leads to script execution. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). Users actively need to add a file to the portal to enable this attack. In case of shared files however, a internal attacker may modify a previously embedded file to carry a malicious file name. Furthermore this vulnerability can be used to persistently execute code that got injected by a temporary script execution vulnerability.

• CWE-79

• http://packetstormsecurity.com/files/137187/Open-Xchange-OX-AppSuite-7.8.0-XSS-Open-Redirect.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/538481/100/0/threaded
• http://packetstormsecurity.com/files/137187/Open-Xchange-OX-AppSuite-7.8.0-XSS-Open-Redirect.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/538481/100/0/threaded

Published

Dec 15, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3167Open redirect vulnerability in the drupal_goto function in D…
• CVE-2016-3168The System module in Drupal 6.x before 6.38 and 7.x before 7…
• CVE-2016-3169The User module in Drupal 6.x before 6.38 and 7.x before 7.4…
• CVE-2016-3170The "have you forgotten your password" links in the User mod…
• CVE-2016-3171Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.…
• CVE-2016-3172SQL injection vulnerability in tree.php in Cacti 0.8.8g and …
• CVE-2016-3174An issue was discovered in Open-Xchange OX AppSuite before 7…
• CVE-2016-3176Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM…
• CVE-2016-3177Multiple use-after-free and double-free vulnerabilities in g…
• CVE-2016-3178The processRequest function in minissdpd.c in MiniSSDPd 1.2.…5.5
• CVE-2016-3179The processRequest function in minissdpd.c in MiniSSDPd 1.2.…5.5
• CVE-2016-3180Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4,…