CVE-2023-26450: XSS
First published: Wed Aug 02 2023(Updated: )
The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.
Credit: security@open-xchange.com security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <=7.10.6 | ||
| Open-xchange Open-xchange Appsuite Frontend | <=7.10.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
- http://seclists.org/fulldisclosure/2023/Aug/8
- http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html
- https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json
Frequently Asked Questions
What is the severity of CVE-2023-26450?
The severity of CVE-2023-26450 is medium with a CVSS score of 5.4.
How does CVE-2023-26450 affect Open-xchange?
CVE-2023-26450 affects Open-xchange Appsuite Frontend version 7.10.6.
What is the vulnerability in CVE-2023-26450?
The vulnerability in CVE-2023-26450 is the failure to specify a media-type when processing responses by external resources in the OX Count web service.
How can CVE-2023-26450 be exploited?
CVE-2023-26450 can be exploited by executing malicious script code within the victim's context, potentially leading to session hijacking or triggering unwanted actions via the web interface and API.
How can CVE-2023-26450 be fixed?
To fix CVE-2023-26450, update Open-xchange Appsuite Frontend to version 7.10.6.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-index
- collector/nvd-latest
- vendor/open-xchange
- canonical/open-xchange open-xchange appsuite frontend
- version/open-xchange open-xchange appsuite frontend/7.10.6