Lucene search

OXCVE-2023-41703

HistoryFeb 12, 2024 - 9:15 a.m.

CVE-2023-41703

2024-02-1209:15:10

CWE-79

web.nvd.nist.gov

cve-2023-41703

information security

code injection

document security

updates

patch releases

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

Percentile

9.0%

JSON

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "office"
    ],
    "product": "OX App Suite",
    "vendor": "Open-Xchange GmbH",
    "versions": [
      {
        "lessThanOrEqual": "7.10.6-rev9",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.19",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json

software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2023-41703