CVE-2020-15003

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (via the session API during shared Drive access).

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://seclists.org/fulldisclosure/2020/Oct/20Exploit, Mailing List, Third Party Advisory
https://www.open-xchange.com/Product
https://seclists.org/fulldisclosure/2020/Oct/20Exploit, Mailing List, Third Party Advisory
https://www.open-xchange.com/Product

Timeline

Published: Oct 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-150044.8OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS.CVE-2020-150053.1In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_a CVE-2020-150065.4Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php.CVE-2020-150079.8A buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe us CVE-2020-150087.5A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation t CVE-2020-150097.8AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2_Upgrade_Tool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 (CVE-2020-15015.4A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S CVE-2020-150114.3GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.CVE-2020-150128.6A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can CVE-2020-150148.8pramodmahato BlogCMS through 2019-12-31 has admin/changepass.php CSRF.CVE-2020-150156.1The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document.CVE-2020-150166.1NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exp