CVE-2022-37308: XSS
Published Dec 26, 2022
·Updated
OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.
Affected Software
53 affected components
Open-Xchange Open-Xchange AppSuite<7.10.5
Open-Xchange Open-Xchange AppSuite=7.10.5
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5961
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5973
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5976
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5982
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5989
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5994
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6000
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6003
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6008
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6010
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6016
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6020
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6026
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6029
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6034
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6035
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6038
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6046
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6051
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6053
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6060
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6061
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6066
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6068
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6072
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6079
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6084
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6092
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6101
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6111
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6120
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6132
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6137
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6140
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6149
Open-Xchange Open-Xchange AppSuite=7.10.6
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6069
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6073
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6080
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6085
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6093
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6102
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6112
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6121
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6133
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6138
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6141
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6146
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6147
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6148
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6150
Event History
Dec 26, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·03:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-37308?
CVE-2022-37308 is considered a moderate severity vulnerability due to its potential for XSS attacks via email messages.
2
How do I fix CVE-2022-37308?
To mitigate CVE-2022-37308, upgrade your Open-Xchange App Suite to version 7.10.7 or later where this vulnerability is patched.
3
What products are affected by CVE-2022-37308?
CVE-2022-37308 affects Open-Xchange App Suite versions 7.10.5 and 7.10.6.
4
What type of vulnerability is CVE-2022-37308?
CVE-2022-37308 is an XSS (Cross-Site Scripting) vulnerability resulting from improperly handled HTML in text/plain email messages.
5
Can CVE-2022-37308 result in data compromise?
Yes, CVE-2022-37308 can allow an attacker to execute malicious scripts in the browser of users who view the affected email.