{"document":{"aggregate_severity":{"text":"HIGH"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"GREEN","url":"https://www.first.org/tlp/"}},"lang":"en-US","publisher":{"category":"vendor","name":"Open-Xchange GmbH","namespace":"https://open-xchange.com/"},"references":[{"category":"external","summary":"Release Notes","url":"https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6292_7.10.6_2024-07-08.pdf"},{"category":"self","summary":"Canonical CSAF document","url":"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0005.json"},{"category":"self","summary":"Markdown representation","url":"https://documentation.open-xchange.com/appsuite/security/advisories/md/2024/oxas-adv-2024-0005.md"},{"category":"self","summary":"HTML representation","url":"https://documentation.open-xchange.com/appsuite/security/advisories/html/2024/oxas-adv-2024-0005.html"},{"category":"self","summary":"Plain-text representation","url":"https://documentation.open-xchange.com/appsuite/security/advisories/txt/2024/oxas-adv-2024-0005.txt"}],"title":"OX App Suite Security Advisory OXAS-ADV-2024-0005","tracking":{"current_release_date":"2024-09-09T00:00:00+00:00","generator":{"date":"2024-09-09T06:40:19+00:00","engine":{"name":"OX CSAF","version":"1.0.0"}},"id":"OXAS-ADV-2024-0005","initial_release_date":"2024-07-08T00:00:00+02:00","revision_history":[{"date":"2024-07-08T00:00:00+02:00","number":"1","summary":"Initial release"},{"date":"2024-09-09T00:00:00+00:00","number":"2","summary":"Public release"}],"status":"final","version":"2"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"7.10.6-rev66","product":{"name":"OX App Suite backend 7.10.6-rev66","product_id":"OXAS-BACKEND_7.10.6-rev66","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:7.10.6:rev66:*:*:*:*:*:*"}}},{"category":"product_version","name":"8.24.7","product":{"name":"OX App Suite backend 8.24.7","product_id":"OXAS-BACKEND_8.24.7","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.24.7:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"7.10.6-rev67","product":{"name":"OX App Suite backend 7.10.6-rev67","product_id":"OXAS-BACKEND_7.10.6-rev67","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:7.10.6:rev67:*:*:*:*:*:*","x_generic_uris":[{"namespace":"https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing","uri":"urn:open-xchange:app_suite:patch-id:6292"}]}}},{"category":"product_version","name":"8.24.8","product":{"name":"OX App Suite backend 8.24.8","product_id":"OXAS-BACKEND_8.24.8","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.24.8:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"OX App Suite backend"}],"category":"vendor","name":"Open-Xchange GmbH"}]},"vulnerabilities":[{"cve":"CVE-2024-22243","cwe":{"id":"CWE-601","name":"URL Redirection to Untrusted Site ('Open Redirect')"},"discovery_date":"2024-03-05T10:13:42+01:00","ids":[{"system_name":"OX Bug","text":"MWB-2534"}],"notes":[{"category":"description","text":"A \"open redirect\" vulnerability has been reported for a version of the Spring Framework which is shipped with OX App Suite."}],"product_status":{"first_fixed":["OXAS-BACKEND_7.10.6-rev67","OXAS-BACKEND_8.24.8"],"last_affected":["OXAS-BACKEND_7.10.6-rev66","OXAS-BACKEND_8.24.7"]},"remediations":[{"category":"vendor_fix","date":"2024-07-08T16:36:19+02:00","details":"Please deploy the provided updates and patch releases. The Spring framework shipped with OX App Suite and depending components has been updated as a precaution to avoid exposure to CVE-2024-22243.","product_ids":["OXAS-BACKEND_7.10.6-rev66","OXAS-BACKEND_8.24.7"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"products":["OXAS-BACKEND_7.10.6-rev66","OXAS-BACKEND_8.24.7"]}],"threats":[{"category":"impact","details":"Please see CVE-2024-22243 \"Spring Framework URL Parsing with Host Validation\" for more information by the vendor of the affected third-party component."},{"category":"exploit_status","details":"No publicly available exploits are known."}],"title":"CVE-2024-22243 Spring Framework URL Parsing with Host Validation"}]}