Lucene search
HistoryDec 26, 2022 - 4:15 a.m.
CVE-2022-37310
cve-2022-37310
ox app suite
xss
metrics
help
uri
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
35.4%
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI.
Affected configurations
Node
open-xchangeopen-xchange_appsuiteRange<7.10.5
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5-
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_5961
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_5973
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_5976
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_5982
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_5989
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_5994
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6000
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6003
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6008
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6010
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6016
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6020
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6026
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6029
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6034
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6035
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6038
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6046
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6051
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6053
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6060
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6061
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6066
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6068
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6072
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6079
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6084
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6092
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6101
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6111
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6120
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6132
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6137
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6140
ORopen-xchangeopen-xchange_appsuiteMatch7.10.5patch_release_6149
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6-
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6069
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6073
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6080
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6085
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6093
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6102
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6112
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6121
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6133
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6138
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6141
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6146
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6147
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6148
ORopen-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6150
Related
cvelist
cvelist
CVE-2022-37310
2022-12-26 00:00:00
prion
prion
Design/Logic Flaw
2022-12-26 04:15:00
nvd
nvd
CVE-2022-37310
2022-12-26 04:15:10
packetstorm
packetstorm
OX App Suite 7.10.6 Cross Site Scripting / SSRF / Resource Consumption
2022-11-30 00:00:00
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
35.4%
Related for CVE-2022-37310