PT-2022-20745 · Open Xchange · Ox App Suite

Published 2022-10-24 · Updated 2022-10-28 · CVE-2022-31468

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OX App Suite versions through 8.2

Description The issue allows for XSS via an attachment or OX Drive content when a client uses the len or off parameter. This can be exploited when the client utilizes specific parameters in conjunction with attachments or OX Drive content.

Recommendations For OX App Suite versions through 8.2, consider disabling the use of the len and off parameters in client requests until a patch is available. Restrict access to attachments and OX Drive content to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31468

Affected Products

Ox App Suite

References · 4

• https://osv.dev/vulnerability/CVE-2022-31468 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31468 · Security Note
• https://packetstormsecurity.com/files/168242/OX-App-Suite-Cross-Site-Scripting-Command-Injection.html · Note
• https://t.me/cibsecurity/52072 · Telegram Post