ByteOS Network

NVD Vulnerability Details :

CVE-2016-6190

Deferred

Source-cve@mitre.org

Published At-17 Feb, 2017 | 17:59

Updated At-20 Apr, 2025 | 01:37

SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary	2.0	4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N

Type: Primary

Version: 3.0

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Type: Primary

Version: 2.0

Base score: 4.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:P/I:N/A:N

CPE Matches

Weaknesses

CWE ID	Type	Source
CWE-200	Primary	nvd@nist.gov

CWE ID: CWE-200

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.openwall.com/lists/oss-security/2016/07/09/3	cve@mitre.org	Mailing List VDB Entry
https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225	cve@mitre.org	Patch
https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d	cve@mitre.org	Patch
https://sogo.nu/bugs/view.php?id=3696	cve@mitre.org	Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/07/09/3	af854a3a-2127-422b-91ae-364da2661108	Mailing List VDB Entry
https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225	af854a3a-2127-422b-91ae-364da2661108	Patch
https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d	af854a3a-2127-422b-91ae-364da2661108	Patch
https://sogo.nu/bugs/view.php?id=3696	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory