cvelistv5 - cve-2023-41707

URL	Tags
security@open-xchange.com	https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json	Vendor Advisory
security@open-xchange.com	https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf	Release Notes

ghsa-f39x-gx7x-wwfj

Vulnerability from github

Published

2024-02-12 09:31

Modified

2024-02-14 18:30

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-41707"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-12T09:15:11Z",
    "severity": "MODERATE"
  },
  "details": "Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\n No publicly available exploits are known.",
  "id": "GHSA-f39x-gx7x-wwfj",
  "modified": "2024-02-14T18:30:24Z",
  "published": "2024-02-12T09:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41707"
    },
    {
      "type": "WEB",
      "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
    },
    {
      "type": "WEB",
      "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/177130/OX-App-Suite-7.10.6-Cross-Site-Scirpting-Denial-Of-Service.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

gsd-2023-41707

Vulnerability from gsd

Modified

2023-12-13 01:20

Details

Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.

Aliases

CVE-2023-41707

Aliases

CVE-2023-41707

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-41707",
    "id": "GSD-2023-41707"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-41707"
      ],
      "details": "Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\r\n No publicly available exploits are known.",
      "id": "GSD-2023-41707",
      "modified": "2023-12-13T01:20:45.699222Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@open-xchange.com",
        "ID": "CVE-2023-41707",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "OX App Suite",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "0",
                          "version_value": "7.10.6-rev55"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Open-Xchange GmbH"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\r\n No publicly available exploits are known."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-400",
                "lang": "eng",
                "value": "Uncontrolled Resource Consumption"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf",
            "refsource": "MISC",
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "name": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json",
            "refsource": "MISC",
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          }
        ]
      },
      "source": {
        "defect": "MWB-2366",
        "discovery": "INTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\r\n No publicly available exploits are known."
          },
          {
            "lang": "es",
            "value": "El procesamiento de expresiones de b\u00fasqueda de correo definidas por el usuario no est\u00e1 limitado. La disponibilidad de OX App Suite podr\u00eda verse reducida debido a la alta carga de procesamiento. Implemente las actualizaciones y lanzamientos de parches proporcionados. Ahora se supervisa el tiempo de procesamiento de las expresiones de b\u00fasqueda de correo y la solicitud relacionada finaliza si se alcanza un umbral de recursos. No se conocen exploits disponibles p\u00fablicamente."
          }
        ],
        "id": "CVE-2023-41707",
        "lastModified": "2024-02-16T14:15:08.187",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "security@open-xchange.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-02-12T09:15:11.253",
        "references": [
          {
            "source": "security@open-xchange.com",
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "source": "security@open-xchange.com",
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          }
        ],
        "sourceIdentifier": "security@open-xchange.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "security@open-xchange.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

OXAS-ADV-2023-0007

Vulnerability from csaf_ox

Published

2023-12-11 00:00

Modified

2024-02-16 00:00

Summary

OX App Suite Security Advisory OXAS-ADV-2023-0007

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "HIGH"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "name": "Open-Xchange GmbH",
      "namespace": "https://open-xchange.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Release Notes",
        "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
      },
      {
        "category": "self",
        "summary": "Canonical CSAF document",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
      },
      {
        "category": "self",
        "summary": "Markdown representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/md/2023/oxas-adv-2023-0007.md"
      },
      {
        "category": "self",
        "summary": "HTML representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/html/2023/oxas-adv-2023-0007.html"
      },
      {
        "category": "self",
        "summary": "Plain-text representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/txt/2023/oxas-adv-2023-0007.txt"
      }
    ],
    "title": "OX App Suite Security Advisory OXAS-ADV-2023-0007",
    "tracking": {
      "current_release_date": "2024-02-16T00:00:00+00:00",
      "generator": {
        "date": "2024-02-16T14:07:05+00:00",
        "engine": {
          "name": "OX CSAF",
          "version": "1.0.0"
        }
      },
      "id": "OXAS-ADV-2023-0007",
      "initial_release_date": "2023-12-11T00:00:00+01:00",
      "revision_history": [
        {
          "date": "2023-12-11T00:00:00+01:00",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2024-02-12T00:00:00+00:00",
          "number": "2",
          "summary": "Public release"
        },
        {
          "date": "2024-02-12T00:00:00+00:00",
          "number": "3",
          "summary": "Public release"
        },
        {
          "date": "2024-02-16T00:00:00+00:00",
          "number": "4",
          "summary": "Public release"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev38",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev38",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev38",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev38:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev39",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev39",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev39",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev39:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite frontend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev55",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev55",
                  "product_id": "OXAS-BACKEND_7.10.6-rev55",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.6.3-rev71",
                "product": {
                  "name": "OX App Suite backend 7.6.3-rev71",
                  "product_id": "OXAS-BACKEND_7.6.3-rev71",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.19",
                "product": {
                  "name": "OX App Suite backend 8.19",
                  "product_id": "OXAS-BACKEND_8.19",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.19:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev56",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev56",
                  "product_id": "OXAS-BACKEND_7.10.6-rev56",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.6.3-rev72",
                "product": {
                  "name": "OX App Suite backend 7.6.3-rev72",
                  "product_id": "OXAS-BACKEND_7.6.3-rev72",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.20",
                "product": {
                  "name": "OX App Suite backend 8.20",
                  "product_id": "OXAS-BACKEND_8.20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.20:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.21",
                "product": {
                  "name": "OX App Suite backend 8.21",
                  "product_id": "OXAS-BACKEND_8.21",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.21:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite backend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev9",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev9",
                  "product_id": "OXAS-OFFICE_7.10.6-rev9",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev9:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.19",
                "product": {
                  "name": "OX App Suite office 8.19",
                  "product_id": "OXAS-OFFICE_8.19",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.19:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev10",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev10",
                  "product_id": "OXAS-OFFICE_7.10.6-rev10",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev10:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.20",
                "product": {
                  "name": "OX App Suite office 8.20",
                  "product_id": "OXAS-OFFICE_8.20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.20:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite office"
          }
        ],
        "category": "vendor",
        "name": "Open-Xchange GmbH"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-41708",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-10-18T13:43:29+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "OXUIB-2599"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "References to the \"app loader\" functionality could contain redirects to unexpected locations."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-FRONTEND_7.10.6-rev39"
        ],
        "last_affected": [
          "OXAS-FRONTEND_7.10.6-rev38"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-01T13:33:11+01:00",
          "details": "Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references.",
          "product_ids": [
            "OXAS-FRONTEND_7.10.6-rev38"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-FRONTEND_7.10.6-rev38"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could forge app references that bypass existing safeguards to inject malicious script code."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS using script code as module at app loader"
    },
    {
      "cve": "CVE-2023-41707",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-02T14:25:28+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2366"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of user-defined mail search expressions is not limited."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.20"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-05T16:40:35+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\r\n",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Excessive resource usage through mail search regex"
    },
    {
      "cve": "CVE-2023-41706",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-02T14:51:43+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2367"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.20"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-01T14:50:22+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Excessive resource usage through drive search regex"
    },
    {
      "cve": "CVE-2023-41705",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-28T15:17:15+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2392"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of user-defined DAV user-agent strings is not limited."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.21"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.20"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-06T12:12:32+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "High resource consumption by manipulated DAV user-agent strings"
    },
    {
      "cve": "CVE-2023-41704",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-11-28T15:26:37+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2393"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.21"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.20"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-06T18:37:10+01:00",
          "details": "Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Malicious script code could be injected to a users sessions when interacting with E-Mails."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS at E-Mail using CSS CID replacement"
    },
    {
      "cve": "CVE-2023-41703",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2022-05-19T15:50:26+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4483"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "User ID references at mentions in document comments were not correctly sanitized."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev10",
          "OXAS-OFFICE_8.20"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev9",
          "OXAS-OFFICE_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-23T11:21:28+02:00",
          "details": "Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev9",
            "OXAS-OFFICE_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev9",
            "OXAS-OFFICE_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Script code could be injected to a users session when working with a malicious document."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "UserIds of mentions are not saved correctly after editing a comment with mentions"
    }
  ]
}

oxas-adv-2023-0007

Vulnerability from csaf_ox

Published

2023-12-11 00:00

Modified

2024-02-16 00:00

Summary

OX App Suite Security Advisory OXAS-ADV-2023-0007

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "HIGH"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "name": "Open-Xchange GmbH",
      "namespace": "https://open-xchange.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Release Notes",
        "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
      },
      {
        "category": "self",
        "summary": "Canonical CSAF document",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
      },
      {
        "category": "self",
        "summary": "Markdown representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/md/2023/oxas-adv-2023-0007.md"
      },
      {
        "category": "self",
        "summary": "HTML representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/html/2023/oxas-adv-2023-0007.html"
      },
      {
        "category": "self",
        "summary": "Plain-text representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/txt/2023/oxas-adv-2023-0007.txt"
      }
    ],
    "title": "OX App Suite Security Advisory OXAS-ADV-2023-0007",
    "tracking": {
      "current_release_date": "2024-02-16T00:00:00+00:00",
      "generator": {
        "date": "2024-02-16T14:07:05+00:00",
        "engine": {
          "name": "OX CSAF",
          "version": "1.0.0"
        }
      },
      "id": "OXAS-ADV-2023-0007",
      "initial_release_date": "2023-12-11T00:00:00+01:00",
      "revision_history": [
        {
          "date": "2023-12-11T00:00:00+01:00",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2024-02-12T00:00:00+00:00",
          "number": "2",
          "summary": "Public release"
        },
        {
          "date": "2024-02-12T00:00:00+00:00",
          "number": "3",
          "summary": "Public release"
        },
        {
          "date": "2024-02-16T00:00:00+00:00",
          "number": "4",
          "summary": "Public release"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev38",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev38",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev38",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev38:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev39",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev39",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev39",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev39:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite frontend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev55",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev55",
                  "product_id": "OXAS-BACKEND_7.10.6-rev55",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.6.3-rev71",
                "product": {
                  "name": "OX App Suite backend 7.6.3-rev71",
                  "product_id": "OXAS-BACKEND_7.6.3-rev71",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.19",
                "product": {
                  "name": "OX App Suite backend 8.19",
                  "product_id": "OXAS-BACKEND_8.19",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.19:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev56",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev56",
                  "product_id": "OXAS-BACKEND_7.10.6-rev56",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.6.3-rev72",
                "product": {
                  "name": "OX App Suite backend 7.6.3-rev72",
                  "product_id": "OXAS-BACKEND_7.6.3-rev72",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.20",
                "product": {
                  "name": "OX App Suite backend 8.20",
                  "product_id": "OXAS-BACKEND_8.20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.20:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.21",
                "product": {
                  "name": "OX App Suite backend 8.21",
                  "product_id": "OXAS-BACKEND_8.21",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.21:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite backend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev9",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev9",
                  "product_id": "OXAS-OFFICE_7.10.6-rev9",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev9:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.19",
                "product": {
                  "name": "OX App Suite office 8.19",
                  "product_id": "OXAS-OFFICE_8.19",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.19:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev10",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev10",
                  "product_id": "OXAS-OFFICE_7.10.6-rev10",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev10:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.20",
                "product": {
                  "name": "OX App Suite office 8.20",
                  "product_id": "OXAS-OFFICE_8.20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.20:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite office"
          }
        ],
        "category": "vendor",
        "name": "Open-Xchange GmbH"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-41708",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-10-18T13:43:29+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "OXUIB-2599"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "References to the \"app loader\" functionality could contain redirects to unexpected locations."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-FRONTEND_7.10.6-rev39"
        ],
        "last_affected": [
          "OXAS-FRONTEND_7.10.6-rev38"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-01T13:33:11+01:00",
          "details": "Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references.",
          "product_ids": [
            "OXAS-FRONTEND_7.10.6-rev38"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-FRONTEND_7.10.6-rev38"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could forge app references that bypass existing safeguards to inject malicious script code."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS using script code as module at app loader"
    },
    {
      "cve": "CVE-2023-41707",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-02T14:25:28+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2366"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of user-defined mail search expressions is not limited."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.20"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-05T16:40:35+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\r\n",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Excessive resource usage through mail search regex"
    },
    {
      "cve": "CVE-2023-41706",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-02T14:51:43+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2367"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.20"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-01T14:50:22+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Excessive resource usage through drive search regex"
    },
    {
      "cve": "CVE-2023-41705",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-28T15:17:15+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2392"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of user-defined DAV user-agent strings is not limited."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.21"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.20"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-06T12:12:32+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "High resource consumption by manipulated DAV user-agent strings"
    },
    {
      "cve": "CVE-2023-41704",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-11-28T15:26:37+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2393"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.21"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.20"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-06T18:37:10+01:00",
          "details": "Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Malicious script code could be injected to a users sessions when interacting with E-Mails."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS at E-Mail using CSS CID replacement"
    },
    {
      "cve": "CVE-2023-41703",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2022-05-19T15:50:26+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4483"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "User ID references at mentions in document comments were not correctly sanitized."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev10",
          "OXAS-OFFICE_8.20"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev9",
          "OXAS-OFFICE_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-23T11:21:28+02:00",
          "details": "Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev9",
            "OXAS-OFFICE_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev9",
            "OXAS-OFFICE_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Script code could be injected to a users session when working with a malicious document."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "UserIds of mentions are not saved correctly after editing a comment with mentions"
    }
  ]
}

cve-2023-41707

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature

Action not permitted

cve-2023-41707

Vulnerability from cvelistv5

ghsa-f39x-gx7x-wwfj

Vulnerability from github

gsd-2023-41707

Vulnerability from gsd

OXAS-ADV-2023-0007

Vulnerability from csaf_ox

oxas-adv-2023-0007

Vulnerability from csaf_ox

Tags

Sightings

Nomenclature