How severe is CVE-2016-6189?

CVE-2016-6189 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2016-6189 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2016-6189?

CVE-2016-6189 affects Alinto Sogo. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2016-6189?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2016-6189 published?

CVE-2016-6189 was published on 2017-02-17 and last updated on 2026-06-17.

CVE-2016-6189

CVE-2016-6189 is a medium-severity vulnerability in Alinto Sogo with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-184.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
CVSS v2: 4.0
EPSS exploit prediction: 1% (69th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-184
Affected product: Alinto Sogo
Published: 2017-02-17
Last modified: 2026-06-17

Description

Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.

Frequently asked questions

What is CVE-2016-6189?: Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
How severe is CVE-2016-6189?: CVE-2016-6189 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2016-6189 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2016-6189?: CVE-2016-6189 affects Alinto Sogo. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2016-6189?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2016-6189 published?: CVE-2016-6189 was published on 2017-02-17 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:alinto:sogo:*:*:*:*:*:*:*:*

More vulnerabilities in Alinto Sogo

CVE-2015-5395 — High (CVSS 8.8): Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
CVE-2016-6188 — Medium (CVSS 6.5): Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number…
CVE-2025-71276 — Medium (CVSS 6.4): SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
CVE-2025-63499 — Medium (CVSS 6.1): Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
CVE-2025-63498 — Medium (CVSS 6.1): alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.
CVE-2024-24510 — Medium (CVSS 6.1): Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via…

All CVEs affecting Alinto Sogo →

Other CWE-184 vulnerabilities

CVE-2026-28363 — Critical (CVSS 9.9): In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option…
CVE-2026-56315 — Critical (CVSS 9.8): picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support,…
CVE-2026-53873 — Critical (CVSS 9.8): picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level…
CVE-2025-71323 — Critical (CVSS 9.8): picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by…
CVE-2025-71320 — Critical (CVSS 9.8): picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller…
CVE-2026-41264 — Critical (CVSS 9.8): Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific…

Browse all CWE-184 vulnerabilities →