CVE-2024-23187
Assigner: OX
Published: 2024-05-06T06:36:39.282Z
State: PUBLISHED
affected: defaultStatus: unaffected
modules: backend
product: OX App Suite
vendor: Open-Xchange GmbH
versions: lessThanOrEqual: 8.21
status: affected
version: 0
versionType: semver
descriptions: value: Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please deploy the provided updates and patch releases. CID replacement has been hardened to omit invalid identifiers. No publicly available exploits are known.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: cwe
source: defect: MWB-2471
discovery: INTERNAL