CVE-2023-41708
Assigner: OX
Published: 2024-02-12T08:15:25.802Z
State: PUBLISHED
affected: defaultStatus: unaffected
modules: frontend
product: OX App Suite
vendor: Open-Xchange GmbH
versions: lessThanOrEqual: 7.10.6-rev38
status: affected
version: 0
versionType: semver
descriptions: value: References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: cwe
source: defect: OXUIB-2599
discovery: INTERNAL