2024-01-08 11:00:32 +00:00
{
"id" : "CVE-2023-41710" ,
"sourceIdentifier" : "security@open-xchange.com" ,
"published" : "2024-01-08T09:15:20.883" ,
2024-01-22 13:00:28 +00:00
"lastModified" : "2024-01-22T11:15:47.500" ,
"vulnStatus" : "Modified" ,
2024-01-08 11:00:32 +00:00
"descriptions" : [
{
"lang" : "en" ,
2024-01-22 13:00:28 +00:00
"value" : "User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known."
2024-01-08 13:00:44 +00:00
} ,
{
"lang" : "es" ,
"value" : "Se podr\u00eda almacenar un c\u00f3digo de secuencia de comandos definido por el usuario para una URL de la tienda relacionada con ventas adicionales. Este c\u00f3digo no se sanitiz\u00f3 correctamente al agregarlo al DOM. Los atacantes podr\u00edan atraer a las v\u00edctimas a cuentas de usuario con c\u00f3digo de script malicioso y obligarlas a ejecutarlo en el contexto de un dominio confiable. Agregamos sanitizaci\u00f3n para este contenido. No se conocen exploits disponibles p\u00fablicamente."
2024-01-08 11:00:32 +00:00
}
] ,
"metrics" : {
"cvssMetricV31" : [
2024-01-12 15:00:29 +00:00
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "LOW" ,
"userInteraction" : "REQUIRED" ,
"scope" : "CHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "LOW" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 5.4 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.3 ,
"impactScore" : 2.7
} ,
2024-01-08 11:00:32 +00:00
{
"source" : "security@open-xchange.com" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "LOW" ,
"userInteraction" : "REQUIRED" ,
"scope" : "CHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "LOW" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 5.4 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.3 ,
"impactScore" : 2.7
}
]
} ,
"weaknesses" : [
2024-01-12 15:00:29 +00:00
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-79"
}
]
} ,
2024-01-08 11:00:32 +00:00
{
"source" : "security@open-xchange.com" ,
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-79"
}
]
}
] ,
2024-01-12 15:00:29 +00:00
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "7.10.6" ,
"matchCriteriaId" : "5BBF1862-B6FF-4F32-A3C1-59D28BA25F81"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "3A4EAD2E-C3C3-4C79-8C42-375FFE638486"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev01:*:*:*:*:*:*" ,
"matchCriteriaId" : "39198733-D227-4935-9A60-1026040D262F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev02:*:*:*:*:*:*" ,
"matchCriteriaId" : "3C86EE81-8CD4-4131-969A-BDA24B9B48E8"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev03:*:*:*:*:*:*" ,
"matchCriteriaId" : "F9E9C869-7DA9-4EFA-B613-82BA127F6CE5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev04:*:*:*:*:*:*" ,
"matchCriteriaId" : "F8FAA329-5893-412B-8349-4DA3023CC76E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev05:*:*:*:*:*:*" ,
"matchCriteriaId" : "BB6A57A4-B18D-498D-9A8C-406797A6255C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev06:*:*:*:*:*:*" ,
"matchCriteriaId" : "7F0977F0-90B4-48B4-BED6-C218B5CA5E03"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev07:*:*:*:*:*:*" ,
"matchCriteriaId" : "4D55DE67-8F93-48F3-BE54-D3A065479281"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev08:*:*:*:*:*:*" ,
"matchCriteriaId" : "D27980B4-B71B-4DA8-B130-F0B5929F8E65"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev09:*:*:*:*:*:*" ,
"matchCriteriaId" : "DD1709BC-7DEB-4508-B3C3-B20F5FD001A3"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:*" ,
"matchCriteriaId" : "08A6BDD5-259E-4DC3-A548-00CD0D459749"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:*" ,
"matchCriteriaId" : "B8166FF4-77D8-4A12-92E5-615B3DA2E602"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:*" ,
"matchCriteriaId" : "999F057B-7918-461A-B60C-3BE72E92CDC9"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:*" ,
"matchCriteriaId" : "88FD1550-3715-493E-B674-9ECF3DD7A813"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:*" ,
"matchCriteriaId" : "F31A4949-397F-4D1B-8AEA-AC7B335722F8"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:*" ,
"matchCriteriaId" : "D33A91D4-CE21-486D-9469-B09060B8C637"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:*" ,
"matchCriteriaId" : "5E3E5CD2-7631-4DBE-AB4D-669E82BCCAD4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:*" ,
"matchCriteriaId" : "2BEE0AF0-3D22-4DE7-9E71-A4469D9CA2EB"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:*" ,
"matchCriteriaId" : "AAFB199C-1D66-442D-AD7E-414DD339E1D3"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:*" ,
"matchCriteriaId" : "26322561-2491-4DC7-B974-0B92B61A5BDA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:*" ,
"matchCriteriaId" : "A6BA6C2B-F2D5-4FF7-B316-C8E99C2B464B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:*" ,
"matchCriteriaId" : "733E4A65-821B-4187-AA3A-1ACD3E882C07"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:*" ,
"matchCriteriaId" : "6B0A0043-33E8-4440-92AC-DDD70EA39535"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:*" ,
"matchCriteriaId" : "303205CC-8BDE-47EE-A675-9BA19983139A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev24:*:*:*:*:*:*" ,
"matchCriteriaId" : "8C088014-47D6-4632-9FB5-2C7B1085B762"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev25:*:*:*:*:*:*" ,
"matchCriteriaId" : "42CF6057-EB40-4208-9F1E-83213E97987C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev26:*:*:*:*:*:*" ,
"matchCriteriaId" : "966BC23E-B8CE-4F98-B3A6-4B620E8808BE"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev27:*:*:*:*:*:*" ,
"matchCriteriaId" : "7409CE19-ACC1-4AF4-8C8A-AE2CDBB63D3D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev28:*:*:*:*:*:*" ,
"matchCriteriaId" : "17D71CDE-3111-459B-8520-F62E0D5D2972"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev29:*:*:*:*:*:*" ,
"matchCriteriaId" : "6D808ED6-F819-4014-BD24-4537D52DDFB0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev30:*:*:*:*:*:*" ,
"matchCriteriaId" : "B3792A91-10E9-42D9-B852-37D369D8364E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev31:*:*:*:*:*:*" ,
"matchCriteriaId" : "6F0BFEEF-8B19-4F71-B7F1-2CC94969616F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev32:*:*:*:*:*:*" ,
"matchCriteriaId" : "52003F06-9351-49B6-A3C5-A2B6FC0B9F4D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev33:*:*:*:*:*:*" ,
"matchCriteriaId" : "C8786112-32AE-4BA5-8D66-D4E2429D3228"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev34:*:*:*:*:*:*" ,
"matchCriteriaId" : "3A67F528-0248-4E24-A5AB-2995ED7D2600"
}
]
}
]
}
] ,
2024-01-08 11:00:32 +00:00
"references" : [
{
2024-01-12 09:00:28 +00:00
"url" : "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json" ,
2024-01-12 15:00:29 +00:00
"source" : "security@open-xchange.com" ,
"tags" : [
"Issue Tracking"
]
2024-01-08 11:00:32 +00:00
} ,
{
"url" : "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf" ,
2024-01-12 15:00:29 +00:00
"source" : "security@open-xchange.com" ,
"tags" : [
"Release Notes"
]
2024-01-08 11:00:32 +00:00
}
]
}
