CVE-2024-23191
Description
Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known.
How to fix
- documentation.open-xchange.com/appsuite/releases/8.21/
- software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf
- documentation.open-xchange.com/appsuite/releases/8.22/
- documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Open-Xchange GmbH OX App Suite | v ≤ 7.10.6-rev40, v ≤ 7.6.3-rev54 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.