PT-2024-12962 · Open Xchange Gmbh+1 · Ox App Suite+2

Published 2024-02-12 · Updated 2024-10-17 · CVE-2023-41704

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions No specific software name or affected versions are mentioned in the provided descriptions.

Description The issue concerns the processing of CID references in E-Mail, which can be exploited to inject malicious script code that bypasses the sanitization engine. This could lead to the injection of malicious script code into a user's session when interacting with E-Mails. The descriptions do not provide details on the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. However, it is mentioned that no publicly available exploits are known.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-41704

Affected Products

Ox App Suite

Open-Xchange

Open-Xchange Appsuite

References · 10

• https://osv.dev/vulnerability/CVE-2023-41704 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41704 · Security Note
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1757006616547774938 · Twitter Post
• http://seclists.org/fulldisclosure/2024/Feb/10 · Note
• https://twitter.com/cracbot/status/1757350431628603789 · Twitter Post
• https://t.me/cvenotify/71023 · Telegram Post
• https://t.me/cvenotify/98559 · Telegram Post
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf · Note
• https://twitter.com/CVEnew/status/1756960689791352865 · Twitter Post