OXAS-ADV-2024-0004
Vulnerability from csaf_ox - Published: 2024-06-13 00:00 - Updated: 2024-08-19 00:00Summary
OX App Suite Security Advisory OXAS-ADV-2024-0004
Severity
Medium
Arbitrary JavaScript execution in PDF.js.
6.1 (Medium)
Vendor Fix
Please deploy the provided updates and patch releases. The relevant components have been updated to mitigate potential exploitation.
References
{
"document": {
"aggregate_severity": {
"text": "MEDIUM"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "GREEN",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"publisher": {
"category": "vendor",
"name": "Open-Xchange GmbH",
"namespace": "https://open-xchange.com/"
},
"references": [
{
"category": "external",
"summary": "Release Notes",
"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6287_7.10.6_2024-06-13.pdf"
},
{
"category": "self",
"summary": "Canonical CSAF document",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0004.json"
},
{
"category": "self",
"summary": "Markdown representation",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/md/2024/oxas-adv-2024-0004.md"
},
{
"category": "self",
"summary": "HTML representation",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/html/2024/oxas-adv-2024-0004.html"
},
{
"category": "self",
"summary": "Plain-text representation",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/txt/2024/oxas-adv-2024-0004.txt"
}
],
"title": "OX App Suite Security Advisory OXAS-ADV-2024-0004",
"tracking": {
"current_release_date": "2024-08-19T00:00:00+00:00",
"generator": {
"date": "2024-08-19T07:26:54+00:00",
"engine": {
"name": "OX CSAF",
"version": "1.0.0"
}
},
"id": "OXAS-ADV-2024-0004",
"initial_release_date": "2024-06-13T00:00:00+02:00",
"revision_history": [
{
"date": "2024-06-13T00:00:00+02:00",
"number": "1",
"summary": "Initial release"
},
{
"date": "2024-08-19T00:00:00+00:00",
"number": "2",
"summary": "Public release"
},
{
"date": "2024-08-19T00:00:00+00:00",
"number": "3",
"summary": "Public release"
},
{
"date": "2024-08-19T00:00:00+00:00",
"number": "4",
"summary": "Public release"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "7.10.6-rev44",
"product": {
"name": "OX App Suite frontend 7.10.6-rev44",
"product_id": "OXAS-FRONTEND_7.10.6-rev44",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev44:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "7.10.6-rev45",
"product": {
"name": "OX App Suite frontend 7.10.6-rev45",
"product_id": "OXAS-FRONTEND_7.10.6-rev45",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev45:*:*:*:*:*:*",
"x_generic_uris": [
{
"namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
"uri": "urn:open-xchange:app_suite:patch-id:6287"
}
]
}
}
}
],
"category": "product_name",
"name": "OX App Suite frontend"
}
],
"category": "vendor",
"name": "Open-Xchange GmbH"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-4367",
"cwe": {
"id": "CWE-80",
"name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
},
"discovery_date": "2024-06-08T14:01:36+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "appsuite/web-apps/ui/-/issues/372"
}
],
"notes": [
{
"category": "description",
"text": "Arbitrary JavaScript execution in PDF.js."
}
],
"product_status": {
"first_fixed": [
"OXAS-FRONTEND_7.10.6-rev45"
],
"last_affected": [
"OXAS-FRONTEND_7.10.6-rev44"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2024-06-13T15:13:17+01:00",
"details": "Please deploy the provided updates and patch releases. The relevant components have been updated to mitigate potential exploitation.",
"product_ids": [
"OXAS-FRONTEND_7.10.6-rev44"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OXAS-FRONTEND_7.10.6-rev44"
]
}
],
"threats": [
{
"category": "impact",
"details": "This update provides safe configuration of a third-party component as a preventive measure to avoid exploitation in the context of OX App Suite."
},
{
"category": "exploit_status",
"details": "Exploits for this vulnerability are publicly available."
}
],
"title": "Arbitrary JavaScript execution in PDF.js"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…