Description
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
References (4)
Scores
CVSS v3
4.3
EPSS
0.0017
EPSS Percentile
38.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-184
Status
published
Products (1)
alinto/sogo
< 2.3.12
Published
Feb 17, 2017
Tracked Since
Feb 18, 2026