CVE-2024-23186
Assigner: OX
Published: 2024-05-06T06:36:38.440Z
State: PUBLISHED
affected: defaultStatus: unaffected
modules: frontend
product: OX App Suite
vendor: Open-Xchange GmbH
versions: lessThanOrEqual: 8.21
status: affected
version: 0
versionType: semver
descriptions: value: E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: cwe
source: defect: OXUIB-2735
discovery: INTERNAL