CVE-2023-41708: XSS
First published: Mon Feb 12 2024(Updated: )
References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.
Credit: security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-Xchange App Suite Backend | <7.10.6 | |
| Open-Xchange App Suite Backend | =7.10.6 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6069 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6073 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6080 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6085 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6093 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6102 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6112 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6121 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6133 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6138 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6141 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6146 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6147 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6148 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6150 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6156 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6161 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6166 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6173 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6176 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6178 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6189 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6194 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6199 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6204 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6205 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6209 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6210 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6214 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6215 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6216 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6218 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6219 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6220 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6227 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6230 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6233 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6235 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6236 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6239 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6241 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6243 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6245 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6248 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6249 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6250 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6251 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6255 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json
- http://packetstormsecurity.com/files/177130/OX-App-Suite-7.10.6-Cross-Site-Scirpting-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2024/Feb/10
Frequently Asked Questions
What is the severity of CVE-2023-41708?
CVE-2023-41708 has been classified with a medium severity due to its potential for cross-site scripting attacks.
How do I fix CVE-2023-41708?
To resolve CVE-2023-41708, you should deploy the latest patch releases provided for Open-Xchange App Suite.
What kind of vulnerability is CVE-2023-41708?
CVE-2023-41708 is a cross-site scripting vulnerability that can allow attackers to inject malicious script code.
What versions of Open-Xchange App Suite are affected by CVE-2023-41708?
CVE-2023-41708 affects Open-Xchange App Suite versions prior to 7.10.6 and all patch releases that do not address this issue.
What should I do if I cannot upgrade my software to fix CVE-2023-41708?
If you cannot upgrade, you should implement additional security measures such as input validation or strict sanitization of URLs to mitigate the effects of CVE-2023-41708.
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- agent/severity
- agent/event
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/open-xchange
- canonical/open-xchange app suite backend
- version/open-xchange app suite backend/7.10.6
- version/open-xchange app suite backend/7.10.6-patch_release_6069
- version/open-xchange app suite backend/7.10.6-patch_release_6073
- version/open-xchange app suite backend/7.10.6-patch_release_6080
- version/open-xchange app suite backend/7.10.6-patch_release_6085
- version/open-xchange app suite backend/7.10.6-patch_release_6093
- version/open-xchange app suite backend/7.10.6-patch_release_6102
- version/open-xchange app suite backend/7.10.6-patch_release_6112
- version/open-xchange app suite backend/7.10.6-patch_release_6121
- version/open-xchange app suite backend/7.10.6-patch_release_6133
- version/open-xchange app suite backend/7.10.6-patch_release_6138
- version/open-xchange app suite backend/7.10.6-patch_release_6141
- version/open-xchange app suite backend/7.10.6-patch_release_6146
- version/open-xchange app suite backend/7.10.6-patch_release_6147
- version/open-xchange app suite backend/7.10.6-patch_release_6148
- version/open-xchange app suite backend/7.10.6-patch_release_6150
- version/open-xchange app suite backend/7.10.6-patch_release_6156
- version/open-xchange app suite backend/7.10.6-patch_release_6161
- version/open-xchange app suite backend/7.10.6-patch_release_6166
- version/open-xchange app suite backend/7.10.6-patch_release_6173
- version/open-xchange app suite backend/7.10.6-patch_release_6176
- version/open-xchange app suite backend/7.10.6-patch_release_6178
- version/open-xchange app suite backend/7.10.6-patch_release_6189
- version/open-xchange app suite backend/7.10.6-patch_release_6194
- version/open-xchange app suite backend/7.10.6-patch_release_6199
- version/open-xchange app suite backend/7.10.6-patch_release_6204
- version/open-xchange app suite backend/7.10.6-patch_release_6205
- version/open-xchange app suite backend/7.10.6-patch_release_6209
- version/open-xchange app suite backend/7.10.6-patch_release_6210
- version/open-xchange app suite backend/7.10.6-patch_release_6214
- version/open-xchange app suite backend/7.10.6-patch_release_6215
- version/open-xchange app suite backend/7.10.6-patch_release_6216
- version/open-xchange app suite backend/7.10.6-patch_release_6218
- version/open-xchange app suite backend/7.10.6-patch_release_6219
- version/open-xchange app suite backend/7.10.6-patch_release_6220
- version/open-xchange app suite backend/7.10.6-patch_release_6227
- version/open-xchange app suite backend/7.10.6-patch_release_6230
- version/open-xchange app suite backend/7.10.6-patch_release_6233
- version/open-xchange app suite backend/7.10.6-patch_release_6235
- version/open-xchange app suite backend/7.10.6-patch_release_6236
- version/open-xchange app suite backend/7.10.6-patch_release_6239
- version/open-xchange app suite backend/7.10.6-patch_release_6241
- version/open-xchange app suite backend/7.10.6-patch_release_6243
- version/open-xchange app suite backend/7.10.6-patch_release_6245
- version/open-xchange app suite backend/7.10.6-patch_release_6248
- version/open-xchange app suite backend/7.10.6-patch_release_6249
- version/open-xchange app suite backend/7.10.6-patch_release_6250
- version/open-xchange app suite backend/7.10.6-patch_release_6251
- version/open-xchange app suite backend/7.10.6-patch_release_6255