CVE-2023-26456
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
18.2%
Users were able to set an arbitrary “product name” for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. Sanitization is in place for product names now. No publicly available exploits are known.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| open-xchange | ox_guard | * | cpe:2.3:a:open-xchange:ox_guard:*:*:*:*:*:*:*:* |
| open-xchange | ox_guard | 2.10.7 | cpe:2.3:a:open-xchange:ox_guard:2.10.7:-:*:*:*:*:*:* |
| open-xchange | ox_guard | 2.10.7 | cpe:2.3:a:open-xchange:ox_guard:2.10.7:rev4:*:*:*:*:*:* |
| open-xchange | ox_guard | 2.10.7 | cpe:2.3:a:open-xchange:ox_guard:2.10.7:rev5:*:*:*:*:*:* |
| open-xchange | ox_guard | 2.10.7 | cpe:2.3:a:open-xchange:ox_guard:2.10.7:rev6:*:*:*:*:*:* |
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
18.2%