CVE-2016-4048 json
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11.
published 2016-12-15 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-5051
- cvss
- 4.3
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 67%
- public exploits
- 0
- none known
Summary
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be shown at the login screen to notify external users about issues with sharing links. This mechanism can be abused to inject arbitrary text messages. Users may get tricked to follow instructions injected by third parties as part of social engineering attacks.
Exploit prediction
1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
References
-
securitytracker.com
/id/1036157
vdb-entry, third-party-advisory
-
securityfocus.com
/archive/1/538732/100/0/threaded
mailing-list
Sources
- CVE List CVE-2016-4048
- NVD CVE-2016-4048
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.