{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2016-6189","sourceIdentifier":"cve@mitre.org","published":"2017-02-17T17:59:00.797","lastModified":"2026-06-17T00:50:36.543","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds."},{"lang":"es","value":"Blacklist incompleta en SOGo en versiones anteriores a 2.3.12 y 3.x en versiones anteriores a 3.1.1 permite a usuarios remotos autenticados obtener información sensible leyendo los campos en la fuente (1) ics o (2) de calendario XML."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-184"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:alinto:sogo:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.12","matchCriteriaId":"5D75E49A-4A29-46E4-82AF-2AF4CA019014"},{"vulnerable":true,"criteria":"cpe:2.3:a:alinto:sogo:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.1.1","matchCriteriaId":"0C9075E1-13A1-42BC-8141-8981BD1B3640"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/07/09/3","source":"cve@mitre.org","tags":["Mailing List","VDB Entry"]},{"url":"https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225","source":"cve@mitre.org","tags":["Patch"]},{"url":"https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d","source":"cve@mitre.org","tags":["Patch"]},{"url":"https://sogo.nu/bugs/view.php?id=3695","source":"cve@mitre.org","tags":["Exploit","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/07/09/3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","VDB Entry"]},{"url":"https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://sogo.nu/bugs/view.php?id=3695","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"]}]}}