CVE-2023-24597

OX App Suite before frontend 7.10.6-rev24 is affected by a vulnerability that allows loading an email messages remote resources during printing without user consent. Root cause: loading remote resources in the print flow (no user interaction). Impact: potential information exposure (confidential...

PT-2023-19702 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev37 Description: The issue allows authenticated users to bypass access controls for reading contacts by moving them to their own address book. Recommendations: For versions prior to 7.10.6-rev37, update...

CVE-2023-24602

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title...

PT-2023-19706 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev37 Description: The issue concerns the lack of HTTP header length checks when downloading data, such as iCal feeds. This could potentially allow a crafted feed to provide an excessive amount of header...

CVE-2023-24597

OX App Suite before frontend 7.10.6-rev24 allows the loading without user consent of an e-mail message's remote resources during printing...

CVE-2023-24602

Open-Xchange OX App Suite prior to frontend 7.10.6-rev24 is affected by CVE-2023-24602, a cross-site scripting (XSS) vulnerability in the Tumblr portal widget that could affect data such as a post title. The issue is documented across multiple sources, with remediation guidance indicating to upgr...

CVE-2023-24598

OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user...

CVE-2023-24603

OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of data...

PT-2023-19704 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev24 Description: The issue allows for XSS via data to the Tumblr portal widget, such as a post title. Recommendations: For versions prior to 7.10.6-rev24, update to version 7.10.6-rev24 or later to...

CVE-2023-24604

OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of header data...

CVE-2023-24600

OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls for reading contacts via a move to their own address book...

PT-2023-19703 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev24 Description: The issue allows for XSS via a non-app deeplink, such as the jslob API's registry sub-tree. Recommendations: For versions prior to 7.10.6-rev24, update to version 7.10.6-rev24 or later ...

CVE-2023-24602

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title...

CVE-2023-24600

OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls for reading contacts via a move to their own address book...

CVE-2023-24605

OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens...

CVE-2023-24599

OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion."...

CVE-2023-24605

OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens...

CVE-2023-24601

CVE-2023-24601 affects Open-Xchange OX App Suite frontend prior to 7.10.6-rev24. An XSS exists via a non-app deeplink, specifically the jslob API’s registry sub-tree, potentially exposing user privacy. Mitigation: upgrade to 7.10.6-rev24 or later; as a temporary measure, restrict access to the js...

CVE-2023-24597

OX App Suite before frontend 7.10.6-rev24 allows the loading without user consent of an e-mail message's remote resources during printing...

CVE-2023-24598

Open-Xchange OX App Suite is affected: versions prior to 7.10.6-rev37 have an information-disclosure vulnerability in the handling of distribution lists, potentially exposing private contacts of other users. The issue is tied to the distribution-list handling in OX App Suite’s backend, with no ex...