CVE-2016-6190 Information

Description

SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes which allows remote authenticated users to obtain sensitive information about appointments with the \View the Date & Time\ restriction as demonstrated by correlating UIDs and DTSTAMPs between all users.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Reference

http://www.openwall.com/lists/oss-security/2016/07/09/3 https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225 https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d https://sogo.nu/bugs/view.php?id=3696

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

LOW

Availability Impact

NONE

Base Score

NONE

Base Severity

4.3