CVE-2017-17062

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated users to save arbitrary user attributes by leveraging improper privilege management.

• CWE-79

• http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jun/23Exploit, Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/44881/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jun/23Exploit, Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/44881/Exploit, Third Party Advisory, VDB Entry

Published

Jun 16, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17056The ZKTime Web Software 2.0.1.12280 allows the Administrator…
• CVE-2017-17057There is a reflected XSS vulnerability in ZKTime Web 2.0.1.1…
• CVE-2017-17058The WooCommerce plugin through 3.x for WordPress has a Direc…7.5
• CVE-2017-17059XSS exists in the amtyThumb amty-thumb-recent-post (aka amty…
• CVE-2017-17060OX Software GmbH OX App Suite 7.8.4 and earlier is affected …
• CVE-2017-17061OX Software GmbH OX App Suite 7.8.4 and earlier is affected …
• CVE-2017-17065An issue was discovered on D-Link DIR-605L Model B before FW…7.5
• CVE-2017-17066The (1) i2pd before 2.17 and (2) kovri pre-alpha implementat…
• CVE-2017-17067Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x …
• CVE-2017-17068A cross-origin vulnerability has been discovered in the Auth…
• CVE-2017-17069ActiveSetupN.exe in Amazon Audible for Windows before Novemb…
• CVE-2017-17070Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…