Vulnerability-Lookup

OXAS-ADV-2023-0007

Vulnerability from csaf_ox - Published: 2023-12-10 23:00 - Updated: 2024-02-16 00:00

Summary

OX App Suite Security Advisory OXAS-ADV-2023-0007

Severity

High

CVE-2023-41708

References to the "app loader" functionality could contain redirects to unexpected locations.

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Last affected 1 product

Product	Identifier	Version	Remediation
OX App Suite frontend 7.10.6-rev38 Open-Xchange GmbH / OX App Suite frontend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev38::::::`	7.10.6-rev38	Vendor Fix

First fixed 1 product

Product	Identifier	Version	Remediation
OX App Suite frontend 7.10.6-rev39 Open-Xchange GmbH / OX App Suite frontend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev39::::::`	7.10.6-rev39

Threats

Impact Attackers could forge app references that bypass existing safeguards to inject malicious script code.

Exploit Status No publicly available exploits are known.

CVE-2023-41707

Processing of user-defined mail search expressions is not limited.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Last affected 3 products

Product	Identifier	Version	Remediation
OX App Suite backend 7.10.6-rev55 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55::::::`	7.10.6-rev55	Vendor Fix
OX App Suite backend 7.6.3-rev71 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71::::::`	7.6.3-rev71	Vendor Fix
OX App Suite backend 8.19 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.19:::::::*`	8.19	Vendor Fix

First fixed 3 products

Product	Identifier	Version
OX App Suite backend 7.10.6-rev56 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56::::::`	7.10.6-rev56
OX App Suite backend 7.6.3-rev72 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72::::::`	7.6.3-rev72
OX App Suite backend 8.20 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.20:::::::*`	8.20

Threats

Impact Availability of OX App Suite could be reduced due to high processing load.

Exploit Status No publicly available exploits are known.

CVE-2023-41706

Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Last affected 3 products, the same list as for CVE-2023-41707

First fixed 3 products, the same list as for CVE-2023-41707

Threats

Impact Availability of OX App Suite could be reduced due to high processing load.

Exploit Status No publicly available exploits are known.

CVE-2023-41705

Processing of user-defined DAV user-agent strings is not limited.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Last affected 3 products

Product	Identifier	Version	Remediation
OX App Suite backend 7.10.6-rev55 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55::::::`	7.10.6-rev55	Vendor Fix
OX App Suite backend 7.6.3-rev71 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71::::::`	7.6.3-rev71	Vendor Fix
OX App Suite backend 8.20 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.20:::::::*`	8.20	Vendor Fix

First fixed 3 products

Product	Identifier	Version
OX App Suite backend 7.10.6-rev56 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56::::::`	7.10.6-rev56
OX App Suite backend 7.6.3-rev72 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72::::::`	7.6.3-rev72
OX App Suite backend 8.21 Open-Xchange GmbH / OX App Suite backend	`cpe:2.3:a:open-xchange:app_suite:8.21:::::::*`	8.21

Threats

Impact Availability of OX App Suite could be reduced due to high processing load.

Exploit Status No publicly available exploits are known.

CVE-2023-41704

Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Last affected 3 products, the same list as for CVE-2023-41705

First fixed 3 products, the same list as for CVE-2023-41705

Threats

Impact Malicious script code could be injected to a users sessions when interacting with E-Mails.

Exploit Status No publicly available exploits are known.

CVE-2023-41703

User ID references at mentions in document comments were not correctly sanitized.

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Last affected 2 products

Product	Identifier	Version	Remediation
OX App Suite office 7.10.6-rev9 Open-Xchange GmbH / OX App Suite office	`cpe:2.3:a:open-xchange:office:7.10.6:rev9::::::`	7.10.6-rev9	Vendor Fix
OX App Suite office 8.19 Open-Xchange GmbH / OX App Suite office	`cpe:2.3:a:open-xchange:office:8.19:::::::*`	8.19	Vendor Fix

First fixed 2 products

Product	Identifier	Version	Remediation
OX App Suite office 7.10.6-rev10 Open-Xchange GmbH / OX App Suite office	`cpe:2.3:a:open-xchange:office:7.10.6:rev10::::::`	7.10.6-rev10
OX App Suite office 8.20 Open-Xchange GmbH / OX App Suite office	`cpe:2.3:a:open-xchange:office:8.20:::::::*`	8.20

Threats

Impact Script code could be injected to a users session when working with a malicious document.

Exploit Status No publicly available exploits are known.

References

5 references

URL	Category
https://software.open-xchange.com/products/appsui…	external
https://documentation.open-xchange.com/appsuite/s…	self
https://documentation.open-xchange.com/appsuite/s…	self
https://documentation.open-xchange.com/appsuite/s…	self
https://documentation.open-xchange.com/appsuite/s…	self

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "HIGH"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "name": "Open-Xchange GmbH",
      "namespace": "https://open-xchange.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Release Notes",
        "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
      },
      {
        "category": "self",
        "summary": "Canonical CSAF document",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
      },
      {
        "category": "self",
        "summary": "Markdown representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/md/2023/oxas-adv-2023-0007.md"
      },
      {
        "category": "self",
        "summary": "HTML representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/html/2023/oxas-adv-2023-0007.html"
      },
      {
        "category": "self",
        "summary": "Plain-text representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/txt/2023/oxas-adv-2023-0007.txt"
      }
    ],
    "title": "OX App Suite Security Advisory OXAS-ADV-2023-0007",
    "tracking": {
      "current_release_date": "2024-02-16T00:00:00+00:00",
      "generator": {
        "date": "2024-02-16T14:07:05+00:00",
        "engine": {
          "name": "OX CSAF",
          "version": "1.0.0"
        }
      },
      "id": "OXAS-ADV-2023-0007",
      "initial_release_date": "2023-12-11T00:00:00+01:00",
      "revision_history": [
        {
          "date": "2023-12-11T00:00:00+01:00",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2024-02-12T00:00:00+00:00",
          "number": "2",
          "summary": "Public release"
        },
        {
          "date": "2024-02-12T00:00:00+00:00",
          "number": "3",
          "summary": "Public release"
        },
        {
          "date": "2024-02-16T00:00:00+00:00",
          "number": "4",
          "summary": "Public release"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev38",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev38",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev38",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev38:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev39",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev39",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev39",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev39:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite frontend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev55",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev55",
                  "product_id": "OXAS-BACKEND_7.10.6-rev55",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.6.3-rev71",
                "product": {
                  "name": "OX App Suite backend 7.6.3-rev71",
                  "product_id": "OXAS-BACKEND_7.6.3-rev71",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.19",
                "product": {
                  "name": "OX App Suite backend 8.19",
                  "product_id": "OXAS-BACKEND_8.19",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.19:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev56",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev56",
                  "product_id": "OXAS-BACKEND_7.10.6-rev56",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.6.3-rev72",
                "product": {
                  "name": "OX App Suite backend 7.6.3-rev72",
                  "product_id": "OXAS-BACKEND_7.6.3-rev72",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.20",
                "product": {
                  "name": "OX App Suite backend 8.20",
                  "product_id": "OXAS-BACKEND_8.20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.20:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.21",
                "product": {
                  "name": "OX App Suite backend 8.21",
                  "product_id": "OXAS-BACKEND_8.21",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.21:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite backend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev9",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev9",
                  "product_id": "OXAS-OFFICE_7.10.6-rev9",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev9:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.19",
                "product": {
                  "name": "OX App Suite office 8.19",
                  "product_id": "OXAS-OFFICE_8.19",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.19:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev10",
                "product": {
                  "name": "OX App Suite office 7.10.6-rev10",
                  "product_id": "OXAS-OFFICE_7.10.6-rev10",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:7.10.6:rev10:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6259"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.20",
                "product": {
                  "name": "OX App Suite office 8.20",
                  "product_id": "OXAS-OFFICE_8.20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:office:8.20:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite office"
          }
        ],
        "category": "vendor",
        "name": "Open-Xchange GmbH"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-41708",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-10-18T13:43:29+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "OXUIB-2599"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "References to the \"app loader\" functionality could contain redirects to unexpected locations."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-FRONTEND_7.10.6-rev39"
        ],
        "last_affected": [
          "OXAS-FRONTEND_7.10.6-rev38"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-01T13:33:11+01:00",
          "details": "Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references.",
          "product_ids": [
            "OXAS-FRONTEND_7.10.6-rev38"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-FRONTEND_7.10.6-rev38"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could forge app references that bypass existing safeguards to inject malicious script code."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS using script code as module at app loader"
    },
    {
      "cve": "CVE-2023-41707",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-02T14:25:28+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2366"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of user-defined mail search expressions is not limited."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.20"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-05T16:40:35+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\r\n",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Excessive resource usage through mail search regex"
    },
    {
      "cve": "CVE-2023-41706",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-02T14:51:43+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2367"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.20"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-01T14:50:22+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "Excessive resource usage through drive search regex"
    },
    {
      "cve": "CVE-2023-41705",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-11-28T15:17:15+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2392"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of user-defined DAV user-agent strings is not limited."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.21"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.20"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-06T12:12:32+01:00",
          "details": "Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Availability of OX App Suite could be reduced due to high processing load."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "High resource consumption by manipulated DAV user-agent strings"
    },
    {
      "cve": "CVE-2023-41704",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-11-28T15:26:37+01:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2393"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev56",
          "OXAS-BACKEND_7.6.3-rev72",
          "OXAS-BACKEND_8.21"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev55",
          "OXAS-BACKEND_7.6.3-rev71",
          "OXAS-BACKEND_8.20"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-12-06T18:37:10+01:00",
          "details": "Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev55",
            "OXAS-BACKEND_7.6.3-rev71",
            "OXAS-BACKEND_8.20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Malicious script code could be injected to a users sessions when interacting with E-Mails."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS at E-Mail using CSS CID replacement"
    },
    {
      "cve": "CVE-2023-41703",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2022-05-19T15:50:26+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "DOCS-4483"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "User ID references at mentions in document comments were not correctly sanitized."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-OFFICE_7.10.6-rev10",
          "OXAS-OFFICE_8.20"
        ],
        "last_affected": [
          "OXAS-OFFICE_7.10.6-rev9",
          "OXAS-OFFICE_8.19"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-23T11:21:28+02:00",
          "details": "Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content.",
          "product_ids": [
            "OXAS-OFFICE_7.10.6-rev9",
            "OXAS-OFFICE_8.19"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-OFFICE_7.10.6-rev9",
            "OXAS-OFFICE_8.19"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Script code could be injected to a users session when working with a malicious document."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "UserIds of mentions are not saved correctly after editing a comment with mentions"
    }
  ]
}

CVE-2023-41703 (GCVE-0-2023-41703)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-22 16:39 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

OX CNA under the mitre root

CNA scorecard C 63/100 over 52 records in the last 180 days details

References

3 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory
http://seclists.org/fulldisclosure/2024/Feb/10

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev9 (semver) Affected: 0 , ≤ 8.19 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41703",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-22T16:39:46.593028Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:21:38.083Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:45.902Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "office"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:48.074Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "DOCS-4483",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41703",
    "datePublished": "2024-02-12T08:15:21.605Z",
    "dateReserved": "2023-08-30T16:21:49.911Z",
    "dateUpdated": "2025-11-04T18:16:45.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-41704 (GCVE-0-2023-41704)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-22 17:54 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

OX CNA under the mitre root

CNA scorecard C 63/100 over 52 records in the last 180 days details

References

3 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory
http://seclists.org/fulldisclosure/2024/Feb/10

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev55 (semver) Affected: 0 , ≤ 7.6.3-rev71 (semver) Affected: 0 , ≤ 8.20 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:47.090Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-22T17:54:46.670204Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T17:55:14.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "backend"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.3-rev71",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:49.359Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "MWB-2393",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41704",
    "datePublished": "2024-02-12T08:15:22.352Z",
    "dateReserved": "2023-08-30T16:21:49.912Z",
    "dateUpdated": "2025-11-04T18:16:47.090Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-41705 (GCVE-0-2023-41705)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-07 19:20 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

OX CNA under the mitre root

CNA scorecard C 63/100 over 52 records in the last 180 days details

References

3 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory
http://seclists.org/fulldisclosure/2024/Feb/10

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev55 (semver) Affected: 0 , ≤ 7.6.3-rev71 (semver) Affected: 0 , ≤ 8.20 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:48.285Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-07T19:20:03.494419Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T19:20:22.352Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "backend"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.3-rev71",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:50.608Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "MWB-2392",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41705",
    "datePublished": "2024-02-12T08:15:23.158Z",
    "dateReserved": "2023-08-30T16:21:49.912Z",
    "dateUpdated": "2025-11-04T18:16:48.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-41706 (GCVE-0-2023-41706)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited No publicly available exploits are known.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-12 16:27 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

OX CNA under the mitre root

CNA scorecard C 63/100 over 52 records in the last 180 days details

References

3 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory
http://seclists.org/fulldisclosure/2024/Feb/10

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev55 (semver) Affected: 0 , ≤ 7.6.3-rev71 (semver) Affected: 0 , ≤ 8.19 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41706",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-12T16:27:35.682374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:20:51.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:49.570Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "backend"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.3-rev71",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:51.845Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "MWB-2367",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41706",
    "datePublished": "2024-02-12T08:15:24.085Z",
    "dateReserved": "2023-08-30T16:21:49.912Z",
    "dateUpdated": "2025-11-04T18:16:49.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-41707 (GCVE-0-2023-41707)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-12 14:28 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

OX CNA under the mitre root

CNA scorecard C 63/100 over 52 records in the last 180 days details

References

3 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory
http://seclists.org/fulldisclosure/2024/Feb/10

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev55 (semver) Affected: 0 , ≤ 7.6.3-rev71 (semver) Affected: 0 , ≤ 8.19 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41707",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-12T14:28:43.049862Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:20:50.823Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:50.752Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "backend"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev55",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.3-rev71",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\r\n No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:53.186Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "MWB-2366",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41707",
    "datePublished": "2024-02-12T08:15:24.923Z",
    "dateReserved": "2023-08-30T16:21:49.912Z",
    "dateUpdated": "2025-11-04T18:16:50.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-41708 (GCVE-0-2023-41708)

Vulnerability from cvelistv5 – Published: 2024-02-12 08:15 – Updated: 2025-11-04 18:16

Summary

References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-12 15:57 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

OX CNA under the mitre root

CNA scorecard C 63/100 over 52 records in the last 180 days details

References

3 references

URL	Tags
https://software.open-xchange.com/products/appsui…	release-notes
https://documentation.open-xchange.com/appsuite/s…	vendor-advisory
http://seclists.org/fulldisclosure/2024/Feb/10

Impacted products

1 product

Vendor	Product	Version
Open-Xchange GmbH	OX App Suite	Affected: 0 , ≤ 7.10.6-rev38 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:16:51.949Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "release-notes",
              "x_transferred"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Feb/10"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41708",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-12T15:57:31.673557Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-06T18:46:26.603Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "frontend"
          ],
          "product": "OX App Suite",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "7.10.6-rev38",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "References to the \"app loader\" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T14:08:54.485Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"
        }
      ],
      "source": {
        "defect": "OXUIB-2599",
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2023-41708",
    "datePublished": "2024-02-12T08:15:25.802Z",
    "dateReserved": "2023-08-30T16:21:49.912Z",
    "dateUpdated": "2025-11-04T18:16:51.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OXAS-ADV-2023-0007

CVE-2023-41703 (GCVE-0-2023-41703)

CVE-2023-41704 (GCVE-0-2023-41704)

CVE-2023-41705 (GCVE-0-2023-41705)

CVE-2023-41706 (GCVE-0-2023-41706)

CVE-2023-41707 (GCVE-0-2023-41707)

CVE-2023-41708 (GCVE-0-2023-41708)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour