CVE-2024-23186: XSS
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23186?
CVE-2024-23186 is considered a high severity vulnerability due to its potential for client-side script execution on specific mobile devices.
How do I fix CVE-2024-23186?
To fix CVE-2024-23186, deploy the provided updates and patch releases for Open-Xchange OX App Suite version 8.22 or later.
What types of attacks are possible with CVE-2024-23186?
CVE-2024-23186 could allow attackers to perform malicious API requests or extract sensitive information from user accounts.
What software is affected by CVE-2024-23186?
CVE-2024-23186 affects Open-Xchange OX App Suite versions prior to 8.22.
When was CVE-2024-23186 discovered?
CVE-2024-23186 was disclosed in May 2024.