Open-Xchange OX App Suite up to 7.10.6-rev34 Upsell Shop URL cross site scripting

Summaryinfo

A vulnerability marked as problematic has been reported in Open-Xchange OX App Suite up to 7.10.6-rev34. The impacted element is an unknown function of the component Upsell Shop URL Handler. This manipulation causes cross site scripting. This vulnerability appears as CVE-2023-41710. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Open-Xchange OX App Suite up to 7.10.6-rev34. It has been declared as problematic. Affected by this vulnerability is an unknown code of the component Upsell Shop URL Handler. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.

The weakness was presented 01/08/2024 as oxas-adv-2023-0006. It is possible to read the advisory at documentation.open-xchange.com. This vulnerability is known as CVE-2023-41710 since 08/30/2023. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Open-Xchange

Name

• OX App Suite

Version

• 7.10.6-rev34

License

• open-source

Website

• Vendor: https://www.open-xchange.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion