CVE-2023-26450: XSS
The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26450?
The severity of CVE-2023-26450 is medium with a CVSS score of 5.4.
How does CVE-2023-26450 affect Open-xchange?
CVE-2023-26450 affects Open-xchange Appsuite Frontend version 7.10.6.
What is the vulnerability in CVE-2023-26450?
The vulnerability in CVE-2023-26450 is the failure to specify a media-type when processing responses by external resources in the OX Count web service.
How can CVE-2023-26450 be exploited?
CVE-2023-26450 can be exploited by executing malicious script code within the victim's context, potentially leading to session hijacking or triggering unwanted actions via the web interface and API.
How can CVE-2023-26450 be fixed?
To fix CVE-2023-26450, update Open-xchange Appsuite Frontend to version 7.10.6.