OXAS-ADV-2024-0002

Vulnerability from csaf_ox - Published: 2024-03-06 00:00 - Updated: 2024-05-06 00:00
Summary
OX App Suite Security Advisory OXAS-ADV-2024-0002
Severity
Medium
CVE-2024-23187

Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vendor Fix Please deploy the provided updates and patch releases. CID replacement has been hardened to omit invalid identifiers.
CVE-2024-23186

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vendor Fix Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface.
CVE-2024-23188

Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interaction is required for the vulnerability to trigger.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vendor Fix Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding attachment information to the web interface.
CVE-2024-23193

E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account.

5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Vendor Fix Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions.
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "text": "MEDIUM"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "name": "Open-Xchange GmbH",
      "namespace": "https://open-xchange.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Release Notes",
        "url": "https://documentation.open-xchange.com/appsuite/releases/8.22/"
      },
      {
        "category": "self",
        "summary": "Canonical CSAF document",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json"
      },
      {
        "category": "self",
        "summary": "Markdown representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/md/2024/oxas-adv-2024-0002.md"
      },
      {
        "category": "self",
        "summary": "HTML representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/html/2024/oxas-adv-2024-0002.html"
      },
      {
        "category": "self",
        "summary": "Plain-text representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/txt/2024/oxas-adv-2024-0002.txt"
      }
    ],
    "title": "OX App Suite Security Advisory OXAS-ADV-2024-0002",
    "tracking": {
      "current_release_date": "2024-05-06T00:00:00+00:00",
      "generator": {
        "date": "2024-05-06T06:36:32+00:00",
        "engine": {
          "name": "OX CSAF",
          "version": "1.0.0"
        }
      },
      "id": "OXAS-ADV-2024-0002",
      "initial_release_date": "2024-03-06T00:00:00+01:00",
      "revision_history": [
        {
          "date": "2024-03-06T00:00:00+01:00",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2024-05-06T00:00:00+00:00",
          "number": "2",
          "summary": "Public release"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "8.21",
                "product": {
                  "name": "OX App Suite backend 8.21",
                  "product_id": "OXAS-BACKEND_8.21",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.21:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.22",
                "product": {
                  "name": "OX App Suite backend 8.22",
                  "product_id": "OXAS-BACKEND_8.22",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.22:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite backend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "8.21",
                "product": {
                  "name": "OX App Suite frontend 8.21",
                  "product_id": "OXAS-FRONTEND_8.21",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.21:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.22",
                "product": {
                  "name": "OX App Suite frontend 8.22",
                  "product_id": "OXAS-FRONTEND_8.22",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.22:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite frontend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "8.21",
                "product": {
                  "name": "OX App Suite office 8.21",
                  "product_id": "OXAS-OFFICE_8.21",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.21:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.22",
                "product": {
                  "name": "OX App Suite office 8.22",
                  "product_id": "OXAS-OFFICE_8.22",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.22:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite office"
          }
        ],
        "category": "vendor",
        "name": "Open-Xchange GmbH"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-23187",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2024-01-29T14:08:40+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2471"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the \"show more\" option."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_8.22"
        ],
        "last_affected": [
          "OXAS-BACKEND_8.21"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-03-04T13:36:19+01:00",
          "details": "Please deploy the provided updates and patch releases. CID replacement has been hardened to omit invalid identifiers.",
          "product_ids": [
            "OXAS-BACKEND_8.21"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_8.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS by abusing CID replacement"
    },
    {
      "cve": "CVE-2024-23186",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2024-02-13T09:15:44+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "OXUIB-2735"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-FRONTEND_8.22"
        ],
        "last_affected": [
          "OXAS-FRONTEND_8.21"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-03-04T13:36:48+01:00",
          "details": "Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface.",
          "product_ids": [
            "OXAS-FRONTEND_8.21"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-FRONTEND_8.22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could perform malicious API requests or extract information from the users account."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS with mail displayname in mobile view"
    },
    {
      "cve": "CVE-2024-23188",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2024-01-10T15:39:11+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "OXUIB-2695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interaction is required for the vulnerability to trigger."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-FRONTEND_8.22"
        ],
        "last_affected": [
          "OXAS-FRONTEND_8.21"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-03-04T13:36:33+01:00",
          "details": "Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding attachment information to the web interface.",
          "product_ids": [
            "OXAS-FRONTEND_8.21"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-FRONTEND_8.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could perform malicious API requests or extract information from the users account."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS using mail attachment file names"
    },
    {
      "cve": "CVE-2024-23193",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2024-01-10T16:26:10+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-5199"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_8.22"
        ],
        "last_affected": [
          "OXAS-OFFICE_8.21"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-02-09T13:17:36+01:00",
          "details": "Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions.",
          "product_ids": [
            "OXAS-OFFICE_8.21"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_8.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Documentconverter allows access to other user exported PDF files"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.