CVE-2016-6847

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as mp3 album covers. In case their XML structure contains script code, that code may get executed when calling the related cover URL. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).

• CWE-79

• http://www.securityfocus.com/bid/93457Third Party Advisory, VDB Entry
• https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3522_7.8.2_2016-08-29.pdfVendor Advisory
• http://www.securityfocus.com/bid/93457Third Party Advisory, VDB Entry
• https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3522_7.8.2_2016-08-29.pdfVendor Advisory

Published

Dec 15, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6840Cross-site scripting (XSS) vulnerability in the management i…
• CVE-2016-6842An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6843An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6844An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6845An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6846Cross-site scripting (XSS) vulnerability in Open-Xchange (OX…
• CVE-2016-6848An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6850An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6851An issue was discovered in Open-Xchange OX Guard before 2.4.…
• CVE-2016-6852An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6853An issue was discovered in Open-Xchange OX Guard before 2.4.…
• CVE-2016-6854An issue was discovered in Open-Xchange OX Guard before 2.4.…