CVE-2023-26445

Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize the theme value and use a default fallback if no theme matches. No publicly available exploits are known.
Configurations

Configuration 1 (hide)

cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:51

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html - Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html - Third Party Advisory, VDB Entry
References () http://seclists.org/fulldisclosure/2023/Aug/8 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2023/Aug/8 - Mailing List, Third Party Advisory
References () https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json - () https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json -
References () https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf - Release Notes () https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf - Release Notes

12 Jan 2024, 08:15

Type Values Removed Values Added
References
  • {'url': 'https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json', 'name': 'https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}
  • () https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json -

07 Aug 2023, 18:19

Type Values Removed Values Added
CPE cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:*:*:*:*:*:*:*:*
CWE CWE-79
First Time Open-xchange open-xchange Appsuite Frontend
Open-xchange
References (MISC) https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json - (MISC) https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json - Vendor Advisory
References (MISC) http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html - (MISC) http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html - Third Party Advisory, VDB Entry
References (MISC) https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf - (MISC) https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf - Release Notes
References (MISC) http://seclists.org/fulldisclosure/2023/Aug/8 - (MISC) http://seclists.org/fulldisclosure/2023/Aug/8 - Mailing List, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.4

03 Aug 2023, 16:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html -

02 Aug 2023, 20:15

Type Values Removed Values Added
References
  • (MISC) http://seclists.org/fulldisclosure/2023/Aug/8 -

02 Aug 2023, 13:30

Type Values Removed Values Added
New CVE

Information

Published : 2023-08-02 13:15

Updated : 2024-11-21 07:51


NVD link : CVE-2023-26445

Mitre link : CVE-2023-26445

CVE.ORG link : CVE-2023-26445


JSON object : View

Products Affected

open-xchange

  • open-xchange_appsuite_frontend
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')