CVE-2023-41703: XSS
First published: Mon Feb 12 2024(Updated: )
User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.
Credit: security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-Xchange App Suite Backend | <7.10.6 | |
| Open-Xchange App Suite Backend | >7.10.6<8.20 | |
| Open-Xchange App Suite Backend | =7.10.6 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6069 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6073 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6080 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6085 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6093 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6102 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6112 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6121 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6133 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6138 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6141 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6146 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6147 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6148 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6150 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6156 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6161 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6166 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6173 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6176 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6178 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6189 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6194 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6199 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6204 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6205 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6209 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6210 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6214 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6215 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6216 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6218 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6219 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6220 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6227 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6230 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6233 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6235 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6236 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6239 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6241 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6243 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6245 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6248 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6249 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6250 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6251 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6255 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json
- http://packetstormsecurity.com/files/177130/OX-App-Suite-7.10.6-Cross-Site-Scirpting-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2024/Feb/10
Frequently Asked Questions
What is the severity of CVE-2023-41703?
CVE-2023-41703 has been rated as a high severity vulnerability due to its potential for script code injection into user sessions.
How do I fix CVE-2023-41703?
To fix CVE-2023-41703, deploy the provided updates and patch releases from Open-Xchange to ensure user-defined content is properly sanitized.
What versions of Open-Xchange App Suite are affected by CVE-2023-41703?
CVE-2023-41703 affects Open-Xchange App Suite versions prior to 7.10.6 and versions between 7.10.6 and 8.20.
What types of attacks does CVE-2023-41703 enable?
CVE-2023-41703 enables potential cross-site scripting attacks by allowing script code injection through non-sanitized user mentions and comments.
What are the potential consequences of CVE-2023-41703?
The consequences of CVE-2023-41703 include unauthorized access to user sessions, allowing attackers to execute arbitrary scripts.
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- agent/severity
- agent/event
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/open-xchange
- canonical/open-xchange app suite backend
- version/open-xchange app suite backend/7.10.6
- version/open-xchange app suite backend/7.10.6-patch_release_6069
- version/open-xchange app suite backend/7.10.6-patch_release_6073
- version/open-xchange app suite backend/7.10.6-patch_release_6080
- version/open-xchange app suite backend/7.10.6-patch_release_6085
- version/open-xchange app suite backend/7.10.6-patch_release_6093
- version/open-xchange app suite backend/7.10.6-patch_release_6102
- version/open-xchange app suite backend/7.10.6-patch_release_6112
- version/open-xchange app suite backend/7.10.6-patch_release_6121
- version/open-xchange app suite backend/7.10.6-patch_release_6133
- version/open-xchange app suite backend/7.10.6-patch_release_6138
- version/open-xchange app suite backend/7.10.6-patch_release_6141
- version/open-xchange app suite backend/7.10.6-patch_release_6146
- version/open-xchange app suite backend/7.10.6-patch_release_6147
- version/open-xchange app suite backend/7.10.6-patch_release_6148
- version/open-xchange app suite backend/7.10.6-patch_release_6150
- version/open-xchange app suite backend/7.10.6-patch_release_6156
- version/open-xchange app suite backend/7.10.6-patch_release_6161
- version/open-xchange app suite backend/7.10.6-patch_release_6166
- version/open-xchange app suite backend/7.10.6-patch_release_6173
- version/open-xchange app suite backend/7.10.6-patch_release_6176
- version/open-xchange app suite backend/7.10.6-patch_release_6178
- version/open-xchange app suite backend/7.10.6-patch_release_6189
- version/open-xchange app suite backend/7.10.6-patch_release_6194
- version/open-xchange app suite backend/7.10.6-patch_release_6199
- version/open-xchange app suite backend/7.10.6-patch_release_6204
- version/open-xchange app suite backend/7.10.6-patch_release_6205
- version/open-xchange app suite backend/7.10.6-patch_release_6209
- version/open-xchange app suite backend/7.10.6-patch_release_6210
- version/open-xchange app suite backend/7.10.6-patch_release_6214
- version/open-xchange app suite backend/7.10.6-patch_release_6215
- version/open-xchange app suite backend/7.10.6-patch_release_6216
- version/open-xchange app suite backend/7.10.6-patch_release_6218
- version/open-xchange app suite backend/7.10.6-patch_release_6219
- version/open-xchange app suite backend/7.10.6-patch_release_6220
- version/open-xchange app suite backend/7.10.6-patch_release_6227
- version/open-xchange app suite backend/7.10.6-patch_release_6230
- version/open-xchange app suite backend/7.10.6-patch_release_6233
- version/open-xchange app suite backend/7.10.6-patch_release_6235
- version/open-xchange app suite backend/7.10.6-patch_release_6236
- version/open-xchange app suite backend/7.10.6-patch_release_6239
- version/open-xchange app suite backend/7.10.6-patch_release_6241
- version/open-xchange app suite backend/7.10.6-patch_release_6243
- version/open-xchange app suite backend/7.10.6-patch_release_6245
- version/open-xchange app suite backend/7.10.6-patch_release_6248
- version/open-xchange app suite backend/7.10.6-patch_release_6249
- version/open-xchange app suite backend/7.10.6-patch_release_6250
- version/open-xchange app suite backend/7.10.6-patch_release_6251
- version/open-xchange app suite backend/7.10.6-patch_release_6255