The open source version of Open-Xchange 0.8.2 and earlier uses a static default username and password with a valid login shell in the initfile for the ldap-server, which allows remote attackers to access any server where the default has not been changed.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Open-xchange | Open-xchange | * | 0.8.2 (including) |
| Open-xchange | Open-xchange | 0.8.1.6 (including) | 0.8.1.6 (including) |