{"document":{"aggregate_severity":{"text":"HIGH"},"category":"csaf_security_advisory","csaf_version":"2.0","lang":"en-US","publisher":{"category":"vendor","name":"Open-Xchange GmbH","namespace":"https://open-xchange.com/"},"references":[{"category":"external","summary":"Release Notes","url":"https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf"},{"category":"self","summary":"Canonical CSAF document","url":"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json"},{"category":"self","summary":"Markdown representation","url":"https://documentation.open-xchange.com/appsuite/security/advisories/md/2023/oxas-adv-2023-0007.md"},{"category":"self","summary":"HTML representation","url":"https://documentation.open-xchange.com/appsuite/security/advisories/html/2023/oxas-adv-2023-0007.html"},{"category":"self","summary":"Plain-text representation","url":"https://documentation.open-xchange.com/appsuite/security/advisories/txt/2023/oxas-adv-2023-0007.txt"}],"title":"OX App Suite Security Advisory OXAS-ADV-2023-0007","tracking":{"current_release_date":"2024-02-16T00:00:00+00:00","generator":{"date":"2024-02-16T14:07:05+00:00","engine":{"name":"OX CSAF","version":"1.0.0"}},"id":"OXAS-ADV-2023-0007","initial_release_date":"2023-12-11T00:00:00+01:00","revision_history":[{"date":"2023-12-11T00:00:00+01:00","number":"1","summary":"Initial release"},{"date":"2024-02-12T00:00:00+00:00","number":"2","summary":"Public release"},{"date":"2024-02-12T00:00:00+00:00","number":"3","summary":"Public release"},{"date":"2024-02-16T00:00:00+00:00","number":"4","summary":"Public release"}],"status":"final","version":"4"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"7.10.6-rev38","product":{"name":"OX App Suite frontend 7.10.6-rev38","product_id":"OXAS-FRONTEND_7.10.6-rev38","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:7.10.6:rev38:*:*:*:*:*:*"}}},{"category":"product_version","name":"7.10.6-rev39","product":{"name":"OX App Suite frontend 7.10.6-rev39","product_id":"OXAS-FRONTEND_7.10.6-rev39","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:7.10.6:rev39:*:*:*:*:*:*","x_generic_uris":[{"namespace":"https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing","uri":"urn:open-xchange:app_suite:patch-id:6259"}]}}}],"category":"product_name","name":"OX App Suite frontend"},{"branches":[{"category":"product_version","name":"7.10.6-rev55","product":{"name":"OX App Suite backend 7.10.6-rev55","product_id":"OXAS-BACKEND_7.10.6-rev55","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:7.10.6:rev55:*:*:*:*:*:*"}}},{"category":"product_version","name":"7.6.3-rev71","product":{"name":"OX App Suite backend 7.6.3-rev71","product_id":"OXAS-BACKEND_7.6.3-rev71","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:7.6.3:rev71:*:*:*:*:*:*"}}},{"category":"product_version","name":"8.19","product":{"name":"OX App Suite backend 8.19","product_id":"OXAS-BACKEND_8.19","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.19:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"7.10.6-rev56","product":{"name":"OX App Suite backend 7.10.6-rev56","product_id":"OXAS-BACKEND_7.10.6-rev56","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:7.10.6:rev56:*:*:*:*:*:*","x_generic_uris":[{"namespace":"https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing","uri":"urn:open-xchange:app_suite:patch-id:6259"}]}}},{"category":"product_version","name":"7.6.3-rev72","product":{"name":"OX App Suite backend 7.6.3-rev72","product_id":"OXAS-BACKEND_7.6.3-rev72","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:7.6.3:rev72:*:*:*:*:*:*","x_generic_uris":[{"namespace":"https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing","uri":"urn:open-xchange:app_suite:patch-id:6259"}]}}},{"category":"product_version","name":"8.20","product":{"name":"OX App Suite backend 8.20","product_id":"OXAS-BACKEND_8.20","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.20:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"8.21","product":{"name":"OX App Suite backend 8.21","product_id":"OXAS-BACKEND_8.21","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.21:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"OX App Suite backend"},{"branches":[{"category":"product_version","name":"7.10.6-rev9","product":{"name":"OX App Suite office 7.10.6-rev9","product_id":"OXAS-OFFICE_7.10.6-rev9","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:office:7.10.6:rev9:*:*:*:*:*:*"}}},{"category":"product_version","name":"8.19","product":{"name":"OX App Suite office 8.19","product_id":"OXAS-OFFICE_8.19","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:office:8.19:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"7.10.6-rev10","product":{"name":"OX App Suite office 7.10.6-rev10","product_id":"OXAS-OFFICE_7.10.6-rev10","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:office:7.10.6:rev10:*:*:*:*:*:*","x_generic_uris":[{"namespace":"https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing","uri":"urn:open-xchange:app_suite:patch-id:6259"}]}}},{"category":"product_version","name":"8.20","product":{"name":"OX App Suite office 8.20","product_id":"OXAS-OFFICE_8.20","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:office:8.20:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"OX App Suite office"}],"category":"vendor","name":"Open-Xchange GmbH"}]},"vulnerabilities":[{"cve":"CVE-2023-41708","cwe":{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"},"discovery_date":"2023-10-18T13:43:29+02:00","ids":[{"system_name":"OX Bug","text":"OXUIB-2599"}],"notes":[{"category":"description","text":"References to the \"app loader\" functionality could contain redirects to unexpected locations."}],"product_status":{"first_fixed":["OXAS-FRONTEND_7.10.6-rev39"],"last_affected":["OXAS-FRONTEND_7.10.6-rev38"]},"remediations":[{"category":"vendor_fix","date":"2023-12-01T13:33:11+01:00","details":"Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references.","product_ids":["OXAS-FRONTEND_7.10.6-rev38"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["OXAS-FRONTEND_7.10.6-rev38"]}],"threats":[{"category":"impact","details":"Attackers could forge app references that bypass existing safeguards to inject malicious script code."},{"category":"exploit_status","details":"No publicly available exploits are known."}],"title":"XSS using script code as module at app loader"},{"cve":"CVE-2023-41707","cwe":{"id":"CWE-400","name":"Uncontrolled Resource Consumption"},"discovery_date":"2023-11-02T14:25:28+01:00","ids":[{"system_name":"OX Bug","text":"MWB-2366"}],"notes":[{"category":"description","text":"Processing of user-defined mail search expressions is not limited."}],"product_status":{"first_fixed":["OXAS-BACKEND_7.10.6-rev56","OXAS-BACKEND_7.6.3-rev72","OXAS-BACKEND_8.20"],"last_affected":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.19"]},"remediations":[{"category":"vendor_fix","date":"2023-12-05T16:40:35+01:00","details":"Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.\r\n","product_ids":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.19"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.19"]}],"threats":[{"category":"impact","details":"Availability of OX App Suite could be reduced due to high processing load."},{"category":"exploit_status","details":"No publicly available exploits are known."}],"title":"Excessive resource usage through mail search regex"},{"cve":"CVE-2023-41706","cwe":{"id":"CWE-400","name":"Uncontrolled Resource Consumption"},"discovery_date":"2023-11-02T14:51:43+01:00","ids":[{"system_name":"OX Bug","text":"MWB-2367"}],"notes":[{"category":"description","text":"Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached."}],"product_status":{"first_fixed":["OXAS-BACKEND_7.10.6-rev56","OXAS-BACKEND_7.6.3-rev72","OXAS-BACKEND_8.20"],"last_affected":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.19"]},"remediations":[{"category":"vendor_fix","date":"2023-12-01T14:50:22+01:00","details":"Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited","product_ids":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.19"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.19"]}],"threats":[{"category":"impact","details":"Availability of OX App Suite could be reduced due to high processing load."},{"category":"exploit_status","details":"No publicly available exploits are known."}],"title":"Excessive resource usage through drive search regex"},{"cve":"CVE-2023-41705","cwe":{"id":"CWE-400","name":"Uncontrolled Resource Consumption"},"discovery_date":"2023-11-28T15:17:15+01:00","ids":[{"system_name":"OX Bug","text":"MWB-2392"}],"notes":[{"category":"description","text":"Processing of user-defined DAV user-agent strings is not limited."}],"product_status":{"first_fixed":["OXAS-BACKEND_7.10.6-rev56","OXAS-BACKEND_7.6.3-rev72","OXAS-BACKEND_8.21"],"last_affected":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.20"]},"remediations":[{"category":"vendor_fix","date":"2023-12-06T12:12:32+01:00","details":"Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached.","product_ids":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.20"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.20"]}],"threats":[{"category":"impact","details":"Availability of OX App Suite could be reduced due to high processing load."},{"category":"exploit_status","details":"No publicly available exploits are known."}],"title":"High resource consumption by manipulated DAV user-agent strings"},{"cve":"CVE-2023-41704","cwe":{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"},"discovery_date":"2023-11-28T15:26:37+01:00","ids":[{"system_name":"OX Bug","text":"MWB-2393"}],"notes":[{"category":"description","text":"Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine."}],"product_status":{"first_fixed":["OXAS-BACKEND_7.10.6-rev56","OXAS-BACKEND_7.6.3-rev72","OXAS-BACKEND_8.21"],"last_affected":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.20"]},"remediations":[{"category":"vendor_fix","date":"2023-12-06T18:37:10+01:00","details":"Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content.","product_ids":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.20"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"products":["OXAS-BACKEND_7.10.6-rev55","OXAS-BACKEND_7.6.3-rev71","OXAS-BACKEND_8.20"]}],"threats":[{"category":"impact","details":"Malicious script code could be injected to a users sessions when interacting with E-Mails."},{"category":"exploit_status","details":"No publicly available exploits are known."}],"title":"XSS at E-Mail using CSS CID replacement"},{"cve":"CVE-2023-41703","cwe":{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"},"discovery_date":"2022-05-19T15:50:26+02:00","ids":[{"system_name":"OX Bug","text":"DOCS-4483"}],"notes":[{"category":"description","text":"User ID references at mentions in document comments were not correctly sanitized."}],"product_status":{"first_fixed":["OXAS-OFFICE_7.10.6-rev10","OXAS-OFFICE_8.20"],"last_affected":["OXAS-OFFICE_7.10.6-rev9","OXAS-OFFICE_8.19"]},"remediations":[{"category":"vendor_fix","date":"2022-05-23T11:21:28+02:00","details":"Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content.","product_ids":["OXAS-OFFICE_7.10.6-rev9","OXAS-OFFICE_8.19"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["OXAS-OFFICE_7.10.6-rev9","OXAS-OFFICE_8.19"]}],"threats":[{"category":"impact","details":"Script code could be injected to a users session when working with a malicious document."},{"category":"exploit_status","details":"No publicly available exploits are known."}],"title":"UserIds of mentions are not saved correctly after editing a comment with mentions"}]}