CVE-2023-41704: XSS
First published: Mon Feb 12 2024(Updated: )
Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.
Credit: security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-Xchange App Suite Backend | <7.6.3 | |
| Open-Xchange App Suite Backend | >7.6.3<7.10.6 | |
| Open-Xchange App Suite Backend | >7.10.6<8.20 | |
| Open-Xchange App Suite Backend | =7.6.3 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_3464 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_3519 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_3569 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_3627 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_3728 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_3875 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_3922 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_3949 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_3991 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_4047 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_4133 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_4423 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_4470 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_4552 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_4667 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_4750 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_4789 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_4839 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_4860 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_4895 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_5104 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_5165 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_5231 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_5537 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_5637 | |
| Open-Xchange App Suite Backend | =7.6.3-patch_release_5910 | |
| Open-Xchange App Suite Backend | =7.10.6 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6069 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6073 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6080 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6085 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6093 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6102 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6112 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6121 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6133 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6138 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6141 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6146 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6147 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6148 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6150 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6156 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6161 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6166 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6173 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6176 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6178 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6189 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6194 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6199 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6204 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6205 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6209 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6210 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6214 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6215 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6216 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6218 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6219 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6220 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6227 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6230 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6233 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6235 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6236 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6239 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6241 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6243 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6245 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6248 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6249 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6250 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6251 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6255 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json
- http://packetstormsecurity.com/files/177130/OX-App-Suite-7.10.6-Cross-Site-Scirpting-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2024/Feb/10
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- agent/event
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/open-xchange
- canonical/open-xchange app suite backend
- version/open-xchange app suite backend/7.6.3
- version/open-xchange app suite backend/7.6.3-patch_release_3464
- version/open-xchange app suite backend/7.6.3-patch_release_3519
- version/open-xchange app suite backend/7.6.3-patch_release_3569
- version/open-xchange app suite backend/7.6.3-patch_release_3627
- version/open-xchange app suite backend/7.6.3-patch_release_3728
- version/open-xchange app suite backend/7.6.3-patch_release_3875
- version/open-xchange app suite backend/7.6.3-patch_release_3922
- version/open-xchange app suite backend/7.6.3-patch_release_3949
- version/open-xchange app suite backend/7.6.3-patch_release_3991
- version/open-xchange app suite backend/7.6.3-patch_release_4047
- version/open-xchange app suite backend/7.6.3-patch_release_4133
- version/open-xchange app suite backend/7.6.3-patch_release_4423
- version/open-xchange app suite backend/7.6.3-patch_release_4470
- version/open-xchange app suite backend/7.6.3-patch_release_4552
- version/open-xchange app suite backend/7.6.3-patch_release_4667
- version/open-xchange app suite backend/7.6.3-patch_release_4750
- version/open-xchange app suite backend/7.6.3-patch_release_4789
- version/open-xchange app suite backend/7.6.3-patch_release_4839
- version/open-xchange app suite backend/7.6.3-patch_release_4860
- version/open-xchange app suite backend/7.6.3-patch_release_4895
- version/open-xchange app suite backend/7.6.3-patch_release_5104
- version/open-xchange app suite backend/7.6.3-patch_release_5165
- version/open-xchange app suite backend/7.6.3-patch_release_5231
- version/open-xchange app suite backend/7.6.3-patch_release_5537
- version/open-xchange app suite backend/7.6.3-patch_release_5637
- version/open-xchange app suite backend/7.6.3-patch_release_5910
- version/open-xchange app suite backend/7.10.6
- version/open-xchange app suite backend/7.10.6-patch_release_6069
- version/open-xchange app suite backend/7.10.6-patch_release_6073
- version/open-xchange app suite backend/7.10.6-patch_release_6080
- version/open-xchange app suite backend/7.10.6-patch_release_6085
- version/open-xchange app suite backend/7.10.6-patch_release_6093
- version/open-xchange app suite backend/7.10.6-patch_release_6102
- version/open-xchange app suite backend/7.10.6-patch_release_6112
- version/open-xchange app suite backend/7.10.6-patch_release_6121
- version/open-xchange app suite backend/7.10.6-patch_release_6133
- version/open-xchange app suite backend/7.10.6-patch_release_6138
- version/open-xchange app suite backend/7.10.6-patch_release_6141
- version/open-xchange app suite backend/7.10.6-patch_release_6146
- version/open-xchange app suite backend/7.10.6-patch_release_6147
- version/open-xchange app suite backend/7.10.6-patch_release_6148
- version/open-xchange app suite backend/7.10.6-patch_release_6150
- version/open-xchange app suite backend/7.10.6-patch_release_6156
- version/open-xchange app suite backend/7.10.6-patch_release_6161
- version/open-xchange app suite backend/7.10.6-patch_release_6166
- version/open-xchange app suite backend/7.10.6-patch_release_6173
- version/open-xchange app suite backend/7.10.6-patch_release_6176
- version/open-xchange app suite backend/7.10.6-patch_release_6178
- version/open-xchange app suite backend/7.10.6-patch_release_6189
- version/open-xchange app suite backend/7.10.6-patch_release_6194
- version/open-xchange app suite backend/7.10.6-patch_release_6199
- version/open-xchange app suite backend/7.10.6-patch_release_6204
- version/open-xchange app suite backend/7.10.6-patch_release_6205
- version/open-xchange app suite backend/7.10.6-patch_release_6209
- version/open-xchange app suite backend/7.10.6-patch_release_6210
- version/open-xchange app suite backend/7.10.6-patch_release_6214
- version/open-xchange app suite backend/7.10.6-patch_release_6215
- version/open-xchange app suite backend/7.10.6-patch_release_6216
- version/open-xchange app suite backend/7.10.6-patch_release_6218
- version/open-xchange app suite backend/7.10.6-patch_release_6219
- version/open-xchange app suite backend/7.10.6-patch_release_6220
- version/open-xchange app suite backend/7.10.6-patch_release_6227
- version/open-xchange app suite backend/7.10.6-patch_release_6230
- version/open-xchange app suite backend/7.10.6-patch_release_6233
- version/open-xchange app suite backend/7.10.6-patch_release_6235
- version/open-xchange app suite backend/7.10.6-patch_release_6236
- version/open-xchange app suite backend/7.10.6-patch_release_6239
- version/open-xchange app suite backend/7.10.6-patch_release_6241
- version/open-xchange app suite backend/7.10.6-patch_release_6243
- version/open-xchange app suite backend/7.10.6-patch_release_6245
- version/open-xchange app suite backend/7.10.6-patch_release_6248
- version/open-xchange app suite backend/7.10.6-patch_release_6249
- version/open-xchange app suite backend/7.10.6-patch_release_6250
- version/open-xchange app suite backend/7.10.6-patch_release_6251
- version/open-xchange app suite backend/7.10.6-patch_release_6255