2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2021-26698" ,
"sourceIdentifier" : "cve@mitre.org" ,
"published" : "2021-07-22T17:15:09.310" ,
"lastModified" : "2022-02-10T17:53:58.420" ,
"vulnStatus" : "Analyzed" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used."
} ,
{
"lang" : "es" ,
"value" : "OX App Suite versiones anteriores a 7.10.3-rev32 y versiones 7.10.4 anteriores a 7.10.4-rev18, permite un ataque de tipo XSS por medio de un fragmento de c\u00f3digo (contenido generado por el usuario) cuando se crea un enlace para compartir y el par\u00e1metro dl es usado"
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "REQUIRED" ,
"scope" : "CHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "LOW" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 6.1 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 2.7
}
] ,
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N" ,
"accessVector" : "NETWORK" ,
"accessComplexity" : "MEDIUM" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "PARTIAL" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 4.3
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 8.6 ,
"impactScore" : 2.9 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : true
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-79"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "D3CF4C4E-3FF0-4B4A-8246-8F8981D66180"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:patch_release5547:*:*:*:*:*:*" ,
"matchCriteriaId" : "4284A4B4-42CF-4196-B990-0DE2AC7FF5F8"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:patch_release5572:*:*:*:*:*:*" ,
"matchCriteriaId" : "1AF0528B-838B-4C80-B91D-D3009EFBD2E5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:patch_release5623:*:*:*:*:*:*" ,
"matchCriteriaId" : "927E4E17-02FC-46D6-B1EE-BBB6C710BE63"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:patch_release5653:*:*:*:*:*:*" ,
"matchCriteriaId" : "43DECDE0-C942-4B4B-A2E1-63B8E32B7334"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:patch_release5677:*:*:*:*:*:*" ,
"matchCriteriaId" : "54F4578F-1515-4F60-B890-421CB3FB09C5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:patch_release5720:*:*:*:*:*:*" ,
"matchCriteriaId" : "8853D9CE-A4F6-4935-BEA2-C039E867ADEF"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev1:*:*:*:*:*:*" ,
"matchCriteriaId" : "3B7503E3-6317-4DD7-9EDD-AB5A0586BADE"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev10:*:*:*:*:*:*" ,
"matchCriteriaId" : "F7FD3C9C-7750-4907-BF23-65606E7A6966"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev11:*:*:*:*:*:*" ,
"matchCriteriaId" : "42BAD919-0599-4303-A7E3-5026AC8F415E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev12:*:*:*:*:*:*" ,
"matchCriteriaId" : "6D0555E6-057D-475D-9EAF-F1EEC2D2157E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev13:*:*:*:*:*:*" ,
"matchCriteriaId" : "CDDA5DF9-62FF-4E6F-943C-C70620D56AE9"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev14:*:*:*:*:*:*" ,
"matchCriteriaId" : "A9C26834-176A-4DD0-816E-87F12C2A0980"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev15:*:*:*:*:*:*" ,
"matchCriteriaId" : "63BA3355-83A5-4758-9208-574760D72AF6"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev16:*:*:*:*:*:*" ,
"matchCriteriaId" : "DEDF0974-91A9-4F6C-B31F-327EBBF2321A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev17:*:*:*:*:*:*" ,
"matchCriteriaId" : "79FED998-07D0-457B-9CC4-1CDE8D6B26E2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev18:*:*:*:*:*:*" ,
"matchCriteriaId" : "27EAB5B4-8F1A-4069-B150-032BADA92C1F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev19:*:*:*:*:*:*" ,
"matchCriteriaId" : "265D758D-DA32-46FC-B7A7-1B695C2E7972"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev2:*:*:*:*:*:*" ,
"matchCriteriaId" : "26BF76EC-F32F-4DAB-8EB0-8B24E76D2593"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev20:*:*:*:*:*:*" ,
"matchCriteriaId" : "FE723E1C-E86A-4BC0-85DD-B051B1773A0A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev21:*:*:*:*:*:*" ,
"matchCriteriaId" : "E441FE6E-2653-4BAE-9EFC-AE195A442804"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev22:*:*:*:*:*:*" ,
"matchCriteriaId" : "516B7ACF-ABB8-4DBA-9E71-3B57B7C74376"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev23:*:*:*:*:*:*" ,
"matchCriteriaId" : "60236FC4-81DA-4ED6-8C5B-6BC9FF6A177B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev24:*:*:*:*:*:*" ,
"matchCriteriaId" : "E186C7BC-F3EC-4B9E-97BC-59CE860DD99B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev25:*:*:*:*:*:*" ,
"matchCriteriaId" : "FE494389-735E-47FC-9A12-5305FA11735F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev26:*:*:*:*:*:*" ,
"matchCriteriaId" : "6BD572F0-1B43-4FB5-BAE2-A9169BACFABE"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev27:*:*:*:*:*:*" ,
"matchCriteriaId" : "CD1EAF9A-189B-47B8-A00A-5604D1B8D8A8"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev28:*:*:*:*:*:*" ,
"matchCriteriaId" : "63318E39-A502-4AD8-9C8D-C15F08847BD8"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev29:*:*:*:*:*:*" ,
"matchCriteriaId" : "59C68527-4F08-4436-9D14-8BA65EEEFFC0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev3:*:*:*:*:*:*" ,
"matchCriteriaId" : "B031D97E-A967-4124-8A42-EFA4B3576124"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev30:*:*:*:*:*:*" ,
"matchCriteriaId" : "79A59F84-11DE-4560-A820-8E4F7B715888"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev31:*:*:*:*:*:*" ,
"matchCriteriaId" : "4C2F2472-91C4-48AF-979A-7C003BBD36CD"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev4:*:*:*:*:*:*" ,
"matchCriteriaId" : "649774E8-6489-4AD7-95A8-AAF7154B2C05"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev5:*:*:*:*:*:*" ,
"matchCriteriaId" : "A2A1BB49-EAFD-4458-AA8B-BF4B195927C5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev6:*:*:*:*:*:*" ,
"matchCriteriaId" : "1AC0DD2C-02D1-4CA9-A05C-81359BD30FA2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev7:*:*:*:*:*:*" ,
"matchCriteriaId" : "720B7107-09AC-41AB-97BB-DFC3FABFDB55"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev8:*:*:*:*:*:*" ,
"matchCriteriaId" : "17E4B9E0-D5D3-4291-91A0-15885B559D5B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.3:rev9:*:*:*:*:*:*" ,
"matchCriteriaId" : "7ECB4D19-C148-473B-B0C0-FD9007912F86"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "89BEBFB4-A028-4D5E-846E-7403D3491147"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev1:*:*:*:*:*:*" ,
"matchCriteriaId" : "FED62869-ACA8-42B1-9AFE-0C0535E2C2F7"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev10:*:*:*:*:*:*" ,
"matchCriteriaId" : "CB85F4BA-8E1B-490A-83FC-906EDF990750"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev11:*:*:*:*:*:*" ,
"matchCriteriaId" : "525841F3-E9ED-4593-9163-9DFA114EF5D6"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev12:*:*:*:*:*:*" ,
"matchCriteriaId" : "6382225F-80C8-4A21-AC5F-E1645B420DD5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev13:*:*:*:*:*:*" ,
"matchCriteriaId" : "3EC95556-A105-4C03-AB54-AAB3A943A22F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev14:*:*:*:*:*:*" ,
"matchCriteriaId" : "34BB4402-3151-4ED1-BC4E-F00A7E5FDB1E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev15:*:*:*:*:*:*" ,
"matchCriteriaId" : "96FB19E6-E819-419A-B2C0-717F196A5A52"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev16:*:*:*:*:*:*" ,
"matchCriteriaId" : "433C2CBB-E3D7-4209-81DA-E183B2BF23A6"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev17:*:*:*:*:*:*" ,
"matchCriteriaId" : "B2117B25-DABE-47B2-9337-5FAC000EC558"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev2:*:*:*:*:*:*" ,
"matchCriteriaId" : "97039EE9-3567-4C10-9A85-8BED8C76BEDF"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev3:*:*:*:*:*:*" ,
"matchCriteriaId" : "AF1AAB93-9205-47FB-BEC3-EC7DF9A20732"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev4:*:*:*:*:*:*" ,
"matchCriteriaId" : "E9A3E84C-665F-470C-8D19-31446ABFF7D3"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev5:*:*:*:*:*:*" ,
"matchCriteriaId" : "45C98776-55CE-4AF8-9141-75E0B86AE844"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev6:*:*:*:*:*:*" ,
"matchCriteriaId" : "E94C88CD-9A26-45DE-A408-956D693FDE29"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev7:*:*:*:*:*:*" ,
"matchCriteriaId" : "005CA94F-FA8A-474C-8135-CA0158D192F8"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev8:*:*:*:*:*:*" ,
"matchCriteriaId" : "4D01DFB9-FFE1-4635-8D59-E2325AADAAF1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.4:rev9:*:*:*:*:*:*" ,
"matchCriteriaId" : "B051C6E0-334E-45A2-990B-81FE7E4FB507"
}
]
}
]
}
] ,
"references" : [
{
"url" : "http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Exploit" ,
"Mailing List" ,
"Third Party Advisory" ,
"VDB Entry"
]
} ,
{
"url" : "http://seclists.org/fulldisclosure/2021/Jul/33" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Exploit" ,
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "https://www.open-xchange.com" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Vendor Advisory"
]
}
]
}
