OXAS-ADV-2023-0004
Vulnerability from csaf_ox
Published
2023-08-01 00:00
Modified
2024-01-22 00:00
Summary
OX App Suite Security Advisory OXAS-ADV-2023-0004


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "text": "CRITICAL"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "name": "Open-Xchange GmbH",
      "namespace": "https://open-xchange.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Release Notes",
        "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf"
      },
      {
        "category": "self",
        "summary": "Canonical CSAF document",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json"
      },
      {
        "category": "self",
        "summary": "Markdown representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/md/2023/oxas-adv-2023-0004.md"
      },
      {
        "category": "self",
        "summary": "HTML representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/html/2023/oxas-adv-2023-0004.html"
      },
      {
        "category": "self",
        "summary": "Plain-text representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/txt/2023/oxas-adv-2023-0004.txt"
      }
    ],
    "title": "OX App Suite Security Advisory OXAS-ADV-2023-0004",
    "tracking": {
      "current_release_date": "2024-01-22T00:00:00+00:00",
      "generator": {
        "date": "2024-01-22T13:14:29+00:00",
        "engine": {
          "name": "OX CSAF",
          "version": "1.0.0"
        }
      },
      "id": "OXAS-ADV-2023-0004",
      "initial_release_date": "2023-08-01T00:00:00+02:00",
      "revision_history": [
        {
          "date": "2023-08-01T00:00:00+02:00",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "2",
          "summary": "Public release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "3",
          "summary": "Public release"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev48",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev48",
                  "product_id": "OXAS-BACKEND_7.10.6-rev48",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev48:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.11",
                "product": {
                  "name": "OX App Suite backend 8.11",
                  "product_id": "OXAS-BACKEND_8.11",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.11:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev49",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev49",
                  "product_id": "OXAS-BACKEND_7.10.6-rev49",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev49:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6243"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.12",
                "product": {
                  "name": "OX App Suite backend 8.12",
                  "product_id": "OXAS-BACKEND_8.12",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.12:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.13",
                "product": {
                  "name": "OX App Suite backend 8.13",
                  "product_id": "OXAS-BACKEND_8.13",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.13:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite backend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.10.7-rev6",
                "product": {
                  "name": "OX App Suite guard 2.10.7-rev6",
                  "product_id": "OXAS-GUARD_2.10.7-rev6",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:guard:2.10.7:rev6:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "2.10.7-rev7",
                "product": {
                  "name": "OX App Suite guard 2.10.7-rev7",
                  "product_id": "OXAS-GUARD_2.10.7-rev7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:guard:2.10.7:rev7:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite guard"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev5",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev5",
                  "product_id": "OXAS-OFFICE_7.10.6-rev5",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev5:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.12",
                "product": {
                  "name": "OX App Suite office 8.12",
                  "product_id": "OXAS-OFFICE_8.12",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.12:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev6",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev6",
                  "product_id": "OXAS-OFFICE_7.10.6-rev6",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev6:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6243"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.13",
                "product": {
                  "name": "OX App Suite office 8.13",
                  "product_id": "OXAS-OFFICE_8.13",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.13:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev7",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev7",
                  "product_id": "OXAS-OFFICE_7.10.6-rev7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev7:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev8",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev8",
                  "product_id": "OXAS-OFFICE_7.10.6-rev8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev8:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6243"
                      }
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite office"
          }
        ],
        "category": "vendor",
        "name": "Open-Xchange GmbH"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-29046",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-01-03T14:25:29+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-1982"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev49",
          "OXAS-BACKEND_8.12"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev48",
          "OXAS-BACKEND_8.11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-07-24T13:31:41+02:00",
          "details": "Please deploy the provided updates and patch releases. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev48",
            "OXAS-BACKEND_8.11"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev48",
            "OXAS-BACKEND_8.11"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Timeouts for external content do not cancel the connection"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Tim Coen"
          ]
        }
      ],
      "cve": "CVE-2023-26455",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2023-01-09T17:03:02+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-1996"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev49",
          "OXAS-BACKEND_8.13"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev48",
          "OXAS-BACKEND_8.12"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-07-25T11:30:00+02:00",
          "details": "Please deploy the provided updates and patch releases. The interface has been updated to require authenticated requests.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev48",
            "OXAS-BACKEND_8.12"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev48",
            "OXAS-BACKEND_8.12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "RMI allows event organizer changes without authentication"
    },
    {
      "cve": "CVE-2023-26456",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-06-22T10:15:46+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "GUARD-440"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Users were able to set an arbitrary \"product name\" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-GUARD_2.10.7-rev7"
        ],
        "last_affected": [
          "OXAS-GUARD_2.10.7-rev6"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-07-06T11:44:45+02:00",
          "details": "Please deploy the provided updates and patch releases. Sanitization is in place for product names now.",
          "product_ids": [
            "OXAS-GUARD_2.10.7-rev6"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-GUARD_2.10.7-rev6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS through unescaped OX Guard \"productName\" property"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Mehmet \u0027mdisec\u0027 Ince"
          ]
        }
      ],
      "cve": "CVE-2023-29047",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2023-03-14T09:38:49+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4767"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev6",
          "OXAS-OFFICE_8.13"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev5",
          "OXAS-OFFICE_8.12"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-04-27T16:55:31+02:00",
          "details": "Please deploy the provided updates and patch releases. All possible IC WebService API request parameters are now validated before further processing. In case invalid parameters are detected, the incident gets logged on level ERROR and BAD_REQUEST (Http code 400) response is returned to caller.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev5",
            "OXAS-OFFICE_8.12"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev5",
            "OXAS-OFFICE_8.12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "SQL Injection at Imageconverter \"getMetadata\""
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Mehmet \u0027mdisec\u0027 Ince"
          ]
        }
      ],
      "cve": "CVE-2023-26452",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2023-03-29T17:23:38+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4800"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev6",
          "OXAS-OFFICE_8.13"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev5",
          "OXAS-OFFICE_8.12"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-04-27T15:40:48+02:00",
          "details": "Please deploy the provided updates and patch releases. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev5",
            "OXAS-OFFICE_8.12"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev5",
            "OXAS-OFFICE_8.12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Arbitrary SQL statements could be executed in the context of the services database user account."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "SQLi at Imageconverter cacheAndGetImageAndMetadata endpoint"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Mehmet \u0027mdisec\u0027 Ince"
          ]
        }
      ],
      "cve": "CVE-2023-26453",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2023-03-29T17:23:40+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev6",
          "OXAS-OFFICE_8.13"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev5",
          "OXAS-OFFICE_8.12"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-04-27T15:46:17+02:00",
          "details": "Please deploy the provided updates and patch releases. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev5",
            "OXAS-OFFICE_8.12"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev5",
            "OXAS-OFFICE_8.12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Arbitrary SQL statements could be executed in the context of the services database user account."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "SQLi at Imageconverter cacheImage endpoint"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Mehmet \u0027mdisec\u0027 Ince"
          ]
        }
      ],
      "cve": "CVE-2023-26454",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2023-03-29T17:23:43+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4802"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev6",
          "OXAS-OFFICE_8.13"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev5",
          "OXAS-OFFICE_8.12"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-04-27T15:49:31+02:00",
          "details": "Please deploy the provided updates and patch releases. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev5",
            "OXAS-OFFICE_8.12"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev5",
            "OXAS-OFFICE_8.12"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Arbitrary SQL statements could be executed in the context of the services database user account."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "SQLi at Imageconverter getMetadata endpoint"
    },
    {
      "cve": "CVE-2023-29045",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-06-22T10:22:30+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4926"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Documents operations, in this case \"drawing\", could be manipulated to contain invalid data types, possibly script code."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev8"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev7"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-07-07T12:49:28+02:00",
          "details": "Please deploy the provided updates and patch releases. Operation data exchanged between collaborating parties does now gets checked for validity to avoid code execution.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS through unescaped \"insertDrawing\" content in collaboration mode"
    },
    {
      "cve": "CVE-2023-29044",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-06-22T10:24:13+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Documents operations could be manipulated to contain invalid data types, possibly script code."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev8"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev7"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-07-07T12:50:11+02:00",
          "details": "Please deploy the provided updates and patch releases. Operation data exchanged between collaborating parties does now get escaped to avoid code execution.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS through unescaped \"imageData\" content in collaboration mode"
    },
    {
      "cve": "CVE-2023-29043",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-06-22T10:26:04+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4928"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev8"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev7"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-06-23T16:16:10+02:00",
          "details": "Please deploy the provided updates and patch releases. The relevant attribute does now get encoded to avoid the possibility of executing script code.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Script code embedded in malicious documents could be executed in the context of the user editing the document when performing certain actions, like copying content."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS through unescaped \"imageSrc\" content at presentations"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.