PT-2021-21636 · Open Xchange · Ox App Suite

Published 2021-07-22 · Updated 2022-02-10 · CVE-2021-37402

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OX App Suite versions prior to 7.10.3-rev32 OX App Suite version 7.10.4 prior to 7.10.4-rev18

Description The issue allows for XSS via binary data that is mishandled when the legacy data retrieval endpoint has been enabled.

Recommendations For OX App Suite versions prior to 7.10.3-rev32, update to version 7.10.3-rev32 or later. For OX App Suite version 7.10.4 prior to 7.10.4-rev18, update to version 7.10.4-rev18 or later. As a temporary workaround, consider disabling the legacy data retrieval endpoint until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-37402

Affected Products

Ox App Suite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-37402 · Security Note
• https://open-xchange.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37402 · Vendor Advisory
• https://t.me/cibsecurity/26414 · Telegram Post
• http://seclists.org/fulldisclosure/2021/Jul/33 · Note