CVE-2021-37402: XSS

Published Jul 22, 2021

Updated

OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled.

Affected Software

56 affected components

Open-Xchange Open-Xchange AppSuite=7.10.3

Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5547

Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5572

Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5623

Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5653

Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5677

Open-Xchange Open-Xchange AppSuite=7.10.3-patch_release5720

Open-Xchange Open-Xchange AppSuite=7.10.3-rev1

Open-Xchange Open-Xchange AppSuite=7.10.3-rev10

Open-Xchange Open-Xchange AppSuite=7.10.3-rev11

Open-Xchange Open-Xchange AppSuite=7.10.3-rev12

Open-Xchange Open-Xchange AppSuite=7.10.3-rev13

Open-Xchange Open-Xchange AppSuite=7.10.3-rev14

Open-Xchange Open-Xchange AppSuite=7.10.3-rev15

Open-Xchange Open-Xchange AppSuite=7.10.3-rev16

Open-Xchange Open-Xchange AppSuite=7.10.3-rev17

Open-Xchange Open-Xchange AppSuite=7.10.3-rev18

Open-Xchange Open-Xchange AppSuite=7.10.3-rev19

Open-Xchange Open-Xchange AppSuite=7.10.3-rev2

Open-Xchange Open-Xchange AppSuite=7.10.3-rev20

Open-Xchange Open-Xchange AppSuite=7.10.3-rev21

Open-Xchange Open-Xchange AppSuite=7.10.3-rev22

Open-Xchange Open-Xchange AppSuite=7.10.3-rev23

Open-Xchange Open-Xchange AppSuite=7.10.3-rev24

Open-Xchange Open-Xchange AppSuite=7.10.3-rev25

Open-Xchange Open-Xchange AppSuite=7.10.3-rev26

Open-Xchange Open-Xchange AppSuite=7.10.3-rev27

Open-Xchange Open-Xchange AppSuite=7.10.3-rev28

Open-Xchange Open-Xchange AppSuite=7.10.3-rev29

Open-Xchange Open-Xchange AppSuite=7.10.3-rev3

Open-Xchange Open-Xchange AppSuite=7.10.3-rev30

Open-Xchange Open-Xchange AppSuite=7.10.3-rev31

Open-Xchange Open-Xchange AppSuite=7.10.3-rev4

Open-Xchange Open-Xchange AppSuite=7.10.3-rev5

Open-Xchange Open-Xchange AppSuite=7.10.3-rev6

Open-Xchange Open-Xchange AppSuite=7.10.3-rev7

Open-Xchange Open-Xchange AppSuite=7.10.3-rev8

Open-Xchange Open-Xchange AppSuite=7.10.3-rev9

Open-Xchange Open-Xchange AppSuite=7.10.4

Open-Xchange Open-Xchange AppSuite=7.10.4-rev1

Open-Xchange Open-Xchange AppSuite=7.10.4-rev10

Open-Xchange Open-Xchange AppSuite=7.10.4-rev11

Open-Xchange Open-Xchange AppSuite=7.10.4-rev12

Open-Xchange Open-Xchange AppSuite=7.10.4-rev13

Open-Xchange Open-Xchange AppSuite=7.10.4-rev14

Open-Xchange Open-Xchange AppSuite=7.10.4-rev15

Open-Xchange Open-Xchange AppSuite=7.10.4-rev16

Open-Xchange Open-Xchange AppSuite=7.10.4-rev17

Open-Xchange Open-Xchange AppSuite=7.10.4-rev2

Open-Xchange Open-Xchange AppSuite=7.10.4-rev3

Open-Xchange Open-Xchange AppSuite=7.10.4-rev4

Open-Xchange Open-Xchange AppSuite=7.10.4-rev5

Open-Xchange Open-Xchange AppSuite=7.10.4-rev6

Open-Xchange Open-Xchange AppSuite=7.10.4-rev7

Open-Xchange Open-Xchange AppSuite=7.10.4-rev8

Open-Xchange Open-Xchange AppSuite=7.10.4-rev9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OX App Suite to a version that resolves this vulnerability.
Fixed in 7.10.3-rev32
Upgrade
Upgrade OX App Suite to a version that resolves this vulnerability.
Fixed in 7.10.4-rev18

Event History

Jul 22, 2021

CVE Published

via MITRE·04:19 PM

Data Sourced

via MITRE·04:19 PM

Description

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2021-37402?

CVE-2021-37402 is classified as a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2021-37402?

To fix CVE-2021-37402, upgrade your Open-Xchange App Suite to version 7.10.3-rev32 or 7.10.4-rev18 or later.

What systems are affected by CVE-2021-37402?

CVE-2021-37402 affects Open-Xchange App Suite versions prior to 7.10.3-rev32 and certain releases of 7.10.4.

What kind of attack can CVE-2021-37402 facilitate?

CVE-2021-37402 allows attackers to execute cross-site scripting (XSS) attacks by exploiting mishandled binary data.

Is the legacy data retrieval endpoint related to CVE-2021-37402?

Yes, the vulnerability occurs when the legacy data retrieval endpoint is enabled, allowing for XSS attacks.