{
  "GSD": {
    "alias": "CVE-2023-41708",
    "id": "GSD-2023-41708"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-41708"
      ],
      "details": "References to the \"app loader\" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.",
      "id": "GSD-2023-41708",
      "modified": "2023-12-13T01:20:45.610287Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@open-xchange.com",
        "ID": "CVE-2023-41708",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "OX App Suite",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "0",
                          "version_value": "7.10.6-rev38"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Open-Xchange GmbH"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "References to the \"app loader\" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-79",
                "lang": "eng",
                "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf",
            "refsource": "MISC",
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "name": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json",
            "refsource": "MISC",
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          }
        ]
      },
      "source": {
        "defect": "OXUIB-2599",
        "discovery": "INTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "References to the \"app loader\" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known."
          },
          {
            "lang": "es",
            "value": "Las referencias a la funcionalidad \"cargador de aplicaciones\" podr\u00edan contener redireccionamientos a ubicaciones inesperadas. Los atacantes podr\u00edan falsificar referencias de aplicaciones que eluden las salvaguardas existentes para inyectar c\u00f3digo de script malicioso. Implemente las actualizaciones y lanzamientos de parches proporcionados. Las referencias a aplicaciones ahora se controlan de manera m\u00e1s estricta para evitar referencias relativas. No se conocen exploits disponibles p\u00fablicamente."
          }
        ],
        "id": "CVE-2023-41708",
        "lastModified": "2024-02-16T14:15:08.263",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 2.7,
              "source": "security@open-xchange.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-02-12T09:15:11.470",
        "references": [
          {
            "source": "security@open-xchange.com",
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "source": "security@open-xchange.com",
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          }
        ],
        "sourceIdentifier": "security@open-xchange.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security@open-xchange.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-41708"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-12T09:15:11Z",
    "severity": "MODERATE"
  },
  "details": "References to the \"app loader\" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.",
  "id": "GHSA-jx74-v4wj-gvx2",
  "modified": "2024-02-14T18:30:24Z",
  "published": "2024-02-12T09:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41708"
    },
    {
      "type": "WEB",
      "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
    },
    {
      "type": "WEB",
      "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/177130/OX-App-Suite-7.10.6-Cross-Site-Scirpting-Denial-Of-Service.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "HIGH"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "name": "Open-Xchange GmbH",
      "namespace": "https://open-xchange.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Release Notes",
        "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
      },
      {
        "category": "self",
        "summary": "Canonical CSAF document",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
      },
      {
        "category": "self",
        "summary": "Markdown representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/md/2023/oxas-adv-2023-0007.md"
      },
      {
        "category": "self",
        "summary": "HTML representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/html/2023/oxas-adv-2023-0007.html"
      },
      {
        "category": "self",
        "summary": "Plain-text representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/txt/2023/oxas-adv-2023-0007.txt"
      }
    ],
    "title": "OX App Suite Security Advisory OXAS-ADV-2023-0007",
    "tracking": {
      "current_release_date": "2024-02-16T00:00:00+00:00",
      "generator": {
        "date": "2024-02-16T14:07:05+00:00",
        "engine": {
          "name": "OX CSAF",
          "version": "1.0.0"
        }
      },
      "id": "OXAS-ADV-2023-0007",
      "initial_release_date": "2023-12-11T00:00:00+01:00",
      "revision_history": [
        {
          "date": "2023-12-11T00:00:00+01:00",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2024-02-12T00:00:00+00:00",
          "number": "2",
          "summary": "Public release"
        },
        {
          "date": "2024-02-12T00:00:00+00:00",
          "number": "3",
          "summary": "Public release"
        },
        {
          "date": "2024-02-16T00:00:00+00:00",
          "number": "4",
          "summary": "Public release"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev38",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev38",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev38",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev38:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev39",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev39",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev39",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev39:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite frontend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev55",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev55",
                  "product_id": "OXAS-BACKEND_7.10.6-rev55",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.6.3-rev71",
                "product": {
                  "name": "OX App Suite backend 7.6.3-rev71",
                  "product_id": "OXAS-BACKEND_7.6.3-rev71",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.19",
                "product": {
                  "name": "OX App Suite backend 8.19",
                  "product_id": "OXAS-BACKEND_8.19",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.19:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev56",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev56",
                  "product_id": "OXAS-BACKEND_7.10.6-rev56",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.6.3-rev72",
                "product": {
                  "name": "OX App Suite backend 7.6.3-rev72",
                  "product_id": "OXAS-BACKEND_7.6.3-rev72",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.20",
                "product": {
                  "name": "OX App Suite backend 8.20",
                  "product_id": "OXAS-BACKEND_8.20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.20:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.21",
                "product": {
                  "name": "OX App Suite backend 8.21",
                  "product_id": "OXAS-BACKEND_8.21",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.21:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite backend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev9",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev9",
                  "product_id": "OXAS-OFFICE_7.10.6-rev9",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev9:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.19",
                "product": {
                  "name": "OX App Suite office 8.19",
                  "product_id": "OXAS-OFFICE_8.19",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.19:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev10",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev10",
                  "product_id": "OXAS-OFFICE_7.10.6-rev10",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev10:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.20",
                "product": {
                  "name": "OX App Suite office 8.20",
                  "product_id": "OXAS-OFFICE_8.20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.20:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite office"
          }
        ],
        "category": "vendor",
        "name": "Open-Xchange GmbH"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-41708",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-10-18T13:43:29+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "OXUIB-2599"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "References to the \"app loader\" functionality could contain redirects to unexpected locations."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-FRONTEND_7.10.6-rev39"
        ],
        "last_affected": [
          "OXAS-FRONTEND_7.10.6-rev38"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-01T13:33:11+01:00",
          "details": "Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references.",
          "product_ids": [
            "OXAS-FRONTEND_7.10.6-rev38"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-FRONTEND_7.10.6-rev38"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could forge app references that bypass existing safeguards to inject malicious script code."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS using script code as module at app loader"
    },
    {
      "cve": "CVE-2023-41707",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-02T14:25:28+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2366"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of user-defined mail search expressions is not limited."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.20"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-05T16:40:35+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\r\n",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Excessive resource usage through mail search regex"
    },
    {
      "cve": "CVE-2023-41706",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-02T14:51:43+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2367"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.20"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-01T14:50:22+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Excessive resource usage through drive search regex"
    },
    {
      "cve": "CVE-2023-41705",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-28T15:17:15+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2392"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of user-defined DAV user-agent strings is not limited."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.21"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.20"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-06T12:12:32+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "High resource consumption by manipulated DAV user-agent strings"
    },
    {
      "cve": "CVE-2023-41704",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-11-28T15:26:37+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2393"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.21"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.20"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-06T18:37:10+01:00",
          "details": "Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Malicious script code could be injected to a users sessions when interacting with E-Mails."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS at E-Mail using CSS CID replacement"
    },
    {
      "cve": "CVE-2023-41703",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2022-05-19T15:50:26+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4483"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "User ID references at mentions in document comments were not correctly sanitized."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev10",
          "OXAS-OFFICE_8.20"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev9",
          "OXAS-OFFICE_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-23T11:21:28+02:00",
          "details": "Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev9",
            "OXAS-OFFICE_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev9",
            "OXAS-OFFICE_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Script code could be injected to a users session when working with a malicious document."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "UserIds of mentions are not saved correctly after editing a comment with mentions"
    }
  ]
}