Vulnerability-Lookup

OXAS-ADV-2023-0007

Vulnerability from csaf_ox - Published: 2023-12-11 00:00 - Updated: 2024-02-16 00:00

Summary

OX App Suite Security Advisory OXAS-ADV-2023-0007

Severity

High

CVE-2023-41708

References to the "app loader" functionality could contain redirects to unexpected locations.

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Last affected 1 product

Product	Identifier	Version	Remediation
OX App Suite frontend 7.10.6-rev38 Open-Xchange GmbH / OX App Suite frontend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev38::::::`	7.10.6-rev38	Vendor Fix

First fixed 1 product

Product	Identifier	Version	Remediation
OX App Suite frontend 7.10.6-rev39 Open-Xchange GmbH / OX App Suite frontend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev39::::::`	7.10.6-rev39

Threats

Impact Attackers could forge app references that bypass existing safeguards to inject malicious script code.

Exploit Status No publicly available exploits are known.

CVE-2023-41707

Processing of user-defined mail search expressions is not limited.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Last affected 3 products

Product	Identifier	Version	Remediation
OX App Suite backend 7.10.6-rev55 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55::::::`	7.10.6-rev55	Vendor Fix
OX App Suite backend 7.6.3-rev71 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71::::::`	7.6.3-rev71	Vendor Fix
OX App Suite backend 8.19 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.19:::::::*`	8.19	Vendor Fix

First fixed 3 products

Product	Identifier	Version
OX App Suite backend 7.10.6-rev56 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56::::::`	7.10.6-rev56
OX App Suite backend 7.6.3-rev72 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72::::::`	7.6.3-rev72
OX App Suite backend 8.20 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.20:::::::*`	8.20

Threats

Impact Availability of OX App Suite could be reduced due to high processing load.

Exploit Status No publicly available exploits are known.

CVE-2023-41706

Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Last affected 3 products

Product	Identifier	Version	Remediation
OX App Suite backend 7.10.6-rev55 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55::::::`	7.10.6-rev55	Vendor Fix
OX App Suite backend 7.6.3-rev71 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71::::::`	7.6.3-rev71	Vendor Fix
OX App Suite backend 8.19 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.19:::::::*`	8.19	Vendor Fix

First fixed 3 products

Product	Identifier	Version
OX App Suite backend 7.10.6-rev56 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56::::::`	7.10.6-rev56
OX App Suite backend 7.6.3-rev72 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72::::::`	7.6.3-rev72
OX App Suite backend 8.20 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.20:::::::*`	8.20

Threats

Impact Availability of OX App Suite could be reduced due to high processing load.

Exploit Status No publicly available exploits are known.

CVE-2023-41705

Processing of user-defined DAV user-agent strings is not limited.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Last affected 3 products

Product	Identifier	Version	Remediation
OX App Suite backend 7.10.6-rev55 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55::::::`	7.10.6-rev55	Vendor Fix
OX App Suite backend 7.6.3-rev71 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71::::::`	7.6.3-rev71	Vendor Fix
OX App Suite backend 8.20 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.20:::::::*`	8.20	Vendor Fix

First fixed 3 products

Product	Identifier	Version
OX App Suite backend 7.10.6-rev56 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56::::::`	7.10.6-rev56
OX App Suite backend 7.6.3-rev72 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72::::::`	7.6.3-rev72
OX App Suite backend 8.21 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.21:::::::*`	8.21

Threats

Impact Availability of OX App Suite could be reduced due to high processing load.

Exploit Status No publicly available exploits are known.

CVE-2023-41704

Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine.

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Last affected 3 products

Product	Identifier	Version	Remediation
OX App Suite backend 7.10.6-rev55 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55::::::`	7.10.6-rev55	Vendor Fix
OX App Suite backend 7.6.3-rev71 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71::::::`	7.6.3-rev71	Vendor Fix
OX App Suite backend 8.20 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.20:::::::*`	8.20	Vendor Fix

First fixed 3 products

Product	Identifier	Version
OX App Suite backend 7.10.6-rev56 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56::::::`	7.10.6-rev56
OX App Suite backend 7.6.3-rev72 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72::::::`	7.6.3-rev72
OX App Suite backend 8.21 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.21:::::::*`	8.21

Threats

Impact Malicious script code could be injected to a users sessions when interacting with E-Mails.

Exploit Status No publicly available exploits are known.

CVE-2023-41703

User ID references at mentions in document comments were not correctly sanitized.

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Last affected 2 products

Product	Identifier	Version	Remediation
OX App Suite office 7.10.6-rev9 Open-Xchange GmbH / OX App Suite office	`cpe:2.3:a:open-xchange:office:7.10.6:rev9::::::`	7.10.6-rev9	Vendor Fix
OX App Suite office 8.19 Open-Xchange GmbH / OX App Suite office	`cpe:2.3:a:open-xchange:office:8.19:::::::*`	8.19	Vendor Fix

First fixed 2 products

Product	Identifier	Version	Remediation
OX App Suite office 7.10.6-rev10 Open-Xchange GmbH / OX App Suite office	`cpe:2.3:a:open-xchange:office:7.10.6:rev10::::::`	7.10.6-rev10
OX App Suite office 8.20 Open-Xchange GmbH / OX App Suite office	`cpe:2.3:a:open-xchange:office:8.20:::::::*`	8.20

Threats

Impact Script code could be injected to a users session when working with a malicious document.

Exploit Status No publicly available exploits are known.

References

5 references

URL	Category
https://software.open-xchange.com/products/appsui…	external
https://documentation.open-xchange.com/appsuite/s…	self
https://documentation.open-xchange.com/appsuite/s…	self
https://documentation.open-xchange.com/appsuite/s…	self
https://documentation.open-xchange.com/appsuite/s…	self

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "HIGH"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "name": "Open-Xchange GmbH",
      "namespace": "https://open-xchange.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Release Notes",
        "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
      },
      {
        "category": "self",
        "summary": "Canonical CSAF document",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
      },
      {
        "category": "self",
        "summary": "Markdown representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/md/2023/oxas-adv-2023-0007.md"
      },
      {
        "category": "self",
        "summary": "HTML representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/html/2023/oxas-adv-2023-0007.html"
      },
      {
        "category": "self",
        "summary": "Plain-text representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/txt/2023/oxas-adv-2023-0007.txt"
      }
    ],
    "title": "OX App Suite Security Advisory OXAS-ADV-2023-0007",
    "tracking": {
      "current_release_date": "2024-02-16T00:00:00+00:00",
      "generator": {
        "date": "2024-02-16T14:07:05+00:00",
        "engine": {
          "name": "OX CSAF",
          "version": "1.0.0"
        }
      },
      "id": "OXAS-ADV-2023-0007",
      "initial_release_date": "2023-12-11T00:00:00+01:00",
      "revision_history": [
        {
          "date": "2023-12-11T00:00:00+01:00",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2024-02-12T00:00:00+00:00",
          "number": "2",
          "summary": "Public release"
        },
        {
          "date": "2024-02-12T00:00:00+00:00",
          "number": "3",
          "summary": "Public release"
        },
        {
          "date": "2024-02-16T00:00:00+00:00",
          "number": "4",
          "summary": "Public release"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev38",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev38",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev38",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev38:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev39",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev39",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev39",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev39:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite frontend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev55",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev55",
                  "product_id": "OXAS-BACKEND_7.10.6-rev55",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.6.3-rev71",
                "product": {
                  "name": "OX App Suite backend 7.6.3-rev71",
                  "product_id": "OXAS-BACKEND_7.6.3-rev71",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.19",
                "product": {
                  "name": "OX App Suite backend 8.19",
                  "product_id": "OXAS-BACKEND_8.19",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.19:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev56",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev56",
                  "product_id": "OXAS-BACKEND_7.10.6-rev56",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.6.3-rev72",
                "product": {
                  "name": "OX App Suite backend 7.6.3-rev72",
                  "product_id": "OXAS-BACKEND_7.6.3-rev72",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.20",
                "product": {
                  "name": "OX App Suite backend 8.20",
                  "product_id": "OXAS-BACKEND_8.20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.20:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.21",
                "product": {
                  "name": "OX App Suite backend 8.21",
                  "product_id": "OXAS-BACKEND_8.21",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.21:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite backend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev9",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev9",
                  "product_id": "OXAS-OFFICE_7.10.6-rev9",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev9:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.19",
                "product": {
                  "name": "OX App Suite office 8.19",
                  "product_id": "OXAS-OFFICE_8.19",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.19:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev10",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev10",
                  "product_id": "OXAS-OFFICE_7.10.6-rev10",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev10:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.20",
                "product": {
                  "name": "OX App Suite office 8.20",
                  "product_id": "OXAS-OFFICE_8.20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.20:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite office"
          }
        ],
        "category": "vendor",
        "name": "Open-Xchange GmbH"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-41708",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-10-18T13:43:29+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "OXUIB-2599"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "References to the \"app loader\" functionality could contain redirects to unexpected locations."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-FRONTEND_7.10.6-rev39"
        ],
        "last_affected": [
          "OXAS-FRONTEND_7.10.6-rev38"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-01T13:33:11+01:00",
          "details": "Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references.",
          "product_ids": [
            "OXAS-FRONTEND_7.10.6-rev38"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-FRONTEND_7.10.6-rev38"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could forge app references that bypass existing safeguards to inject malicious script code."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS using script code as module at app loader"
    },
    {
      "cve": "CVE-2023-41707",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-02T14:25:28+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2366"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of user-defined mail search expressions is not limited."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.20"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-05T16:40:35+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\r\n",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Excessive resource usage through mail search regex"
    },
    {
      "cve": "CVE-2023-41706",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-02T14:51:43+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2367"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.20"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-01T14:50:22+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Excessive resource usage through drive search regex"
    },
    {
      "cve": "CVE-2023-41705",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-28T15:17:15+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2392"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of user-defined DAV user-agent strings is not limited."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.21"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.20"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-06T12:12:32+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "High resource consumption by manipulated DAV user-agent strings"
    },
    {
      "cve": "CVE-2023-41704",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-11-28T15:26:37+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2393"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.21"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.20"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-06T18:37:10+01:00",
          "details": "Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Malicious script code could be injected to a users sessions when interacting with E-Mails."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS at E-Mail using CSS CID replacement"
    },
    {
      "cve": "CVE-2023-41703",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2022-05-19T15:50:26+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4483"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "User ID references at mentions in document comments were not correctly sanitized."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev10",
          "OXAS-OFFICE_8.20"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev9",
          "OXAS-OFFICE_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-23T11:21:28+02:00",
          "details": "Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev9",
            "OXAS-OFFICE_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev9",
            "OXAS-OFFICE_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Script code could be injected to a users session when working with a malicious document."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "UserIds of mentions are not saved correctly after editing a comment with mentions"
    }
  ]
}

CVE-2023-41703 (GCVE-0-2023-41703)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

References

2 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev9 (semver) Affected: 0 , ≤ 8.19 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41703",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-22T16:39:46.593028Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:21:38.083Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:45.902Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "office"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:48.074Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "DOCS-4483",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41703",
    "datePublished": "2024-02-12T08:15:21.605Z",
    "dateReserved": "2023-08-30T16:21:49.911Z",
    "dateUpdated": "2025-11-04T18:16:45.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-41704 (GCVE-0-2023-41704)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

References

2 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev55 (semver) Affected: 0 , ≤ 7.6.3-rev71 (semver) Affected: 0 , ≤ 8.20 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:47.090Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-22T17:54:46.670204Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T17:55:14.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "backend"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.3-rev71",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:49.359Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "MWB-2393",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41704",
    "datePublished": "2024-02-12T08:15:22.352Z",
    "dateReserved": "2023-08-30T16:21:49.912Z",
    "dateUpdated": "2025-11-04T18:16:47.090Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-41705 (GCVE-0-2023-41705)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

References

2 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev55 (semver) Affected: 0 , ≤ 7.6.3-rev71 (semver) Affected: 0 , ≤ 8.20 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:48.285Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-07T19:20:03.494419Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T19:20:22.352Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "backend"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.3-rev71",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:50.608Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "MWB-2392",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41705",
    "datePublished": "2024-02-12T08:15:23.158Z",
    "dateReserved": "2023-08-30T16:21:49.912Z",
    "dateUpdated": "2025-11-04T18:16:48.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-41706 (GCVE-0-2023-41706)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited No publicly available exploits are known.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

References

2 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev55 (semver) Affected: 0 , ≤ 7.6.3-rev71 (semver) Affected: 0 , ≤ 8.19 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41706",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-12T16:27:35.682374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:20:51.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:49.570Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "backend"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.3-rev71",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:51.845Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "MWB-2367",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41706",
    "datePublished": "2024-02-12T08:15:24.085Z",
    "dateReserved": "2023-08-30T16:21:49.912Z",
    "dateUpdated": "2025-11-04T18:16:49.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-41707 (GCVE-0-2023-41707)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

References

2 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev55 (semver) Affected: 0 , ≤ 7.6.3-rev71 (semver) Affected: 0 , ≤ 8.19 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41707",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-12T14:28:43.049862Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:20:50.823Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:50.752Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "backend"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.3-rev71",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\r\n No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:53.186Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "MWB-2366",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41707",
    "datePublished": "2024-02-12T08:15:24.923Z",
    "dateReserved": "2023-08-30T16:21:49.912Z",
    "dateUpdated": "2025-11-04T18:16:50.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-41708 (GCVE-0-2023-41708)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

References

2 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev38 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:51.949Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41708",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-12T15:57:31.673557Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-06T18:46:26.603Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "frontend"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev38",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "References to the \"app loader\" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:54.485Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "OXUIB-2599",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41708",
    "datePublished": "2024-02-12T08:15:25.802Z",
    "dateReserved": "2023-08-30T16:21:49.912Z",
    "dateUpdated": "2025-11-04T18:16:51.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OXAS-ADV-2023-0007

CVE-2023-41703 (GCVE-0-2023-41703)

CVE-2023-41704 (GCVE-0-2023-41704)

CVE-2023-41705 (GCVE-0-2023-41705)

CVE-2023-41706 (GCVE-0-2023-41706)

CVE-2023-41707 (GCVE-0-2023-41707)

CVE-2023-41708 (GCVE-0-2023-41708)

Tags

Sightings

Nomenclature