Lucene search

OXCVE-2024-23191

HistoryApr 08, 2024 - 9:15 a.m.

CVE-2024-23191

2024-04-0809:15:09

CWE-79

web.nvd.nist.gov

upsell manipulation

script code execution

social engineering attack

api requests

patched vulnerability

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

6.8

Confidence

High

EPSS

Percentile

15.5%

JSON

Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "frontend"
    ],
    "product": "OX App Suite",
    "vendor": "Open-Xchange GmbH",
    "versions": [
      {
        "lessThanOrEqual": "7.10.6-rev40",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.6.3-rev54",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

documentation.open-xchange.com/appsuite/releases/8.21/

documentation.open-xchange.com/appsuite/releases/8.22/

documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json

software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf