PT-2021-20156 · Open Xchange · Ox App Suite

Published 2021-11-22 · Updated 2021-11-23 · CVE-2021-33494

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OX App Suite version 7.10.5

Description The issue allows for XSS via an OX Chat room title during typing rendering. This means that an attacker could potentially inject malicious scripts into the chat room title, which would then be executed by the browser, allowing for unauthorized actions.

Recommendations For OX App Suite version 7.10.5, consider disabling the chat room title rendering feature until a patch is available to prevent potential XSS attacks. Restrict access to the OX Chat room title feature to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33494

Affected Products

Ox App Suite

References · 6

• 🔥 https://seclists.org/fulldisclosure/2021/Nov/42 · Exploit
• 🔥 http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33494 · Security Note
• https://open-xchange.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33494 · Vendor Advisory
• https://t.me/cvenotify/23628 · Telegram Post