CVE-2016-6189 json
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by readin…
published 2017-02-17 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-7122
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known
Summary
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
Patch / fix
- alinto sogo 2.3.12, 3.1.1
- sogo Debian 13, Debian 12 3.2.4-0.2
debian advisories DEBIAN-CVE-2016-6189
Exploit prediction
1.41% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- sogo.nu https://sogo.nu/bugs/view.php?id=3695 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-184 Incomplete List of Disallowed Inputs
References
-
github.com
/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d
patch
-
github.com
/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225
patch
-
sogo.nu
/bugs/view.php?id=3695
exploit, vendor-advisory
-
openwall.com
/lists/oss-security/2016/07/09/3
mailing-list, vdb-entry
Sources
- CVE List CVE-2016-6189
- NVD CVE-2016-6189
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.