{"id":"CVE-2016-6190","aliases":["DEBIAN-CVE-2016-6190","EUVD-2016-7123","GHSA-2xqv-f63h-r6rj","UBUNTU-CVE-2016-6190"],"status":"published","title":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP...","description":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date \u0026 Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01239,"percentile":0.69292,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-02-17T17:00:00Z","modified":"2026-10-20T13:17:58Z","fixes":[{"ecosystem":"Debian:12","package":"sogo","fixed_in":["3.2.4-0.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sogo","fixed_in":["3.2.4-0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-0.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-0.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.17a-1","2.2.17a-1.1","2.2.17a-1.1build1","2.2.17a-1.1ubuntu0.1~esm1"]}],"products":[{"vendor":"inverse-inc","product":"sogo"}],"references":[{"url":"https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://sogo.nu/bugs/view.php?id=3696","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/07/09/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6190"},{"url":"https://github.com/advisories/GHSA-2xqv-f63h-r6rj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-6190","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-6190","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6190","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-6190","description":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date \u0026 Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.","status":"published","published":"2017-02-17T17:00:00Z","modified":"2024-08-06T01:22:20.665Z","updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2016-7123","description":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date \u0026 Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.","status":"published","published":"2017-02-17T17:00:00Z","modified":"2024-08-06T01:22:20Z","updated_at":"2026-11-03T02:22:40.469928Z"}],"ghsa":[{"id":"GHSA-2xqv-f63h-r6rj","title":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP...","description":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date \u0026 Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.","status":"published","published":"2022-05-17T02:58:01Z","modified":"2023-01-27T05:06:18Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:42:53.481756Z"}],"nvd":[{"id":"CVE-2016-6190","description":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date \u0026 Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.","status":"published","published":"2017-02-17T17:59:00.843Z","modified":"2026-06-17T00:50:36.65Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"CVE-2016-6190","description":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date \u0026 Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.","status":"published","published":"2017-02-17T17:59:00.843Z","modified":"2026-10-20T13:17:58.794223195Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-6190","description":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date \u0026 Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.","status":"published","published":"2017-02-17T17:59:00.843Z","modified":"2026-09-22T07:01:45.655016323Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-6190","description":"SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the \"View the Date \u0026 Time\" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.","status":"published","published":"2017-02-17T17:59:00Z","modified":"2026-07-06T02:45:08.563582068Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:12.642042Z"}]}}