CVE-2016-6189

MEDIUM

SOGo < 2.3.12 and 3.x < 3.1.1 - Authenticated Information Disclosure via Calendar Feed Fields

Title source: llm
STIX 2.1

Description

Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.

References (4)

Core 4

Scores

CVSS v3 4.3
EPSS 0.0140
EPSS Percentile 68.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-184
Status published
Products (1)
alinto/sogo < 2.3.12
Published Feb 17, 2017
Tracked Since Feb 18, 2026