{"document":{"aggregate_severity":{"text":"HIGH"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"text":"Copyright © Open-Xchange GmbH. All rights reserved.","tlp":{"label":"GREEN","url":"https://www.first.org/tlp/"}},"lang":"en-US","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution-NoDerivatives 4.0 International License (https://creativecommons.org/licenses/by-nd/4.0/). If you distribute this content, you must provide attribution to Open-Xchange GmbH and provide a link to the original. You may not distribute a modified version of this content.","title":"Terms of Use"}],"publisher":{"category":"vendor","name":"Open-Xchange GmbH","namespace":"https://open-xchange.com/"},"references":[{"category":"self","summary":"Canonical CSAF document","url":"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2025/oxas-adv-2025-0002.json"},{"category":"self","summary":"Markdown representation","url":"https://documentation.open-xchange.com/appsuite/security/advisories/md/2025/oxas-adv-2025-0002.md"},{"category":"self","summary":"HTML representation","url":"https://documentation.open-xchange.com/appsuite/security/advisories/html/2025/oxas-adv-2025-0002.html"},{"category":"self","summary":"Plain-text representation","url":"https://documentation.open-xchange.com/appsuite/security/advisories/txt/2025/oxas-adv-2025-0002.txt"}],"title":"OX App Suite Security Advisory OXAS-ADV-2025-0002","tracking":{"current_release_date":"2025-10-31T00:00:00+00:00","generator":{"date":"2025-10-31T08:54:35+00:00","engine":{"name":"OX CSAF","version":"1.0.0"}},"id":"OXAS-ADV-2025-0002","initial_release_date":"2025-08-12T00:00:00+02:00","revision_history":[{"date":"2025-08-12T00:00:00+02:00","number":"1","summary":"Initial release"},{"date":"2025-10-31T00:00:00+00:00","number":"2","summary":"Public release"}],"status":"final","version":"2"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"7.6.3-rev77","product":{"name":"OX App Suite backend 7.6.3-rev77","product_id":"OXAS-BACKEND_7.6.3-rev77","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:7.6.3:rev77:*:*:*:*:*:*"}}},{"category":"product_version","name":"8.35.111","product":{"name":"OX App Suite backend 8.35.111","product_id":"OXAS-BACKEND_8.35.111","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.35.111:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"8.38.82","product":{"name":"OX App Suite backend 8.38.82","product_id":"OXAS-BACKEND_8.38.82","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.38.82:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"8.39.79","product":{"name":"OX App Suite backend 8.39.79","product_id":"OXAS-BACKEND_8.39.79","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.39.79:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"8.40.57","product":{"name":"OX App Suite backend 8.40.57","product_id":"OXAS-BACKEND_8.40.57","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.40.57:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"7.6.3-rev78","product":{"name":"OX App Suite backend 7.6.3-rev78","product_id":"OXAS-BACKEND_7.6.3-rev78","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:7.6.3:rev78:*:*:*:*:*:*","x_generic_uris":[{"namespace":"https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing","uri":"urn:open-xchange:app_suite:patch-id:6319"}]}}},{"category":"product_version","name":"8.35.112","product":{"name":"OX App Suite backend 8.35.112","product_id":"OXAS-BACKEND_8.35.112","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.35.112:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"8.38.83","product":{"name":"OX App Suite backend 8.38.83","product_id":"OXAS-BACKEND_8.38.83","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.38.83:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"8.39.80","product":{"name":"OX App Suite backend 8.39.80","product_id":"OXAS-BACKEND_8.39.80","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.39.80:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"8.40.58","product":{"name":"OX App Suite backend 8.40.58","product_id":"OXAS-BACKEND_8.40.58","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:app_suite:8.40.58:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"OX App Suite backend"},{"branches":[{"category":"product_version","name":"2.1.7","product":{"name":"OX App Suite uimiddleware 2.1.7","product_id":"OXAS-UIMIDDLEWARE_2.1.7","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:uimiddleware:2.1.7:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"2.1.8","product":{"name":"OX App Suite uimiddleware 2.1.8","product_id":"OXAS-UIMIDDLEWARE_2.1.8","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:uimiddleware:2.1.8:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"OX App Suite uimiddleware"}],"category":"vendor","name":"Open-Xchange GmbH"}]},"vulnerabilities":[{"cve":"CVE-2025-30191","cwe":{"id":"CWE-1021","name":"Improper Restriction of Rendered UI Layers or Frames"},"discovery_date":"2025-07-09T22:43:52.947000+02:00","ids":[{"system_name":"GitLab Issue","text":"appsuite/platform/core#336"}],"notes":[{"category":"description","text":"Malicious content from E-Mail can be used to perform a redressing attack."}],"product_status":{"first_fixed":["OXAS-BACKEND_7.6.3-rev78","OXAS-BACKEND_8.35.112","OXAS-BACKEND_8.38.83","OXAS-BACKEND_8.39.80","OXAS-BACKEND_8.40.58"],"last_affected":["OXAS-BACKEND_7.6.3-rev77","OXAS-BACKEND_8.35.111","OXAS-BACKEND_8.38.82","OXAS-BACKEND_8.39.79","OXAS-BACKEND_8.40.57"]},"remediations":[{"category":"vendor_fix","date":"2025-07-10T12:51:41.085000+02:00","details":"Attribute values containing HTML fragments are now denied by the sanitization procedure.","product_ids":["OXAS-BACKEND_7.6.3-rev77","OXAS-BACKEND_8.35.111","OXAS-BACKEND_8.38.82","OXAS-BACKEND_8.39.79","OXAS-BACKEND_8.40.57"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"products":["OXAS-BACKEND_7.6.3-rev77","OXAS-BACKEND_8.35.111","OXAS-BACKEND_8.38.82","OXAS-BACKEND_8.39.79","OXAS-BACKEND_8.40.57"]}],"threats":[{"category":"impact","details":"Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats."},{"category":"exploit_status","details":"No publicly available exploits are known"}],"title":"HTML \"form\" elements can be used for spoofing and redressing"},{"cve":"CVE-2025-30188","cwe":{"id":"CWE-400","name":"Uncontrolled Resource Consumption"},"discovery_date":"2025-08-06T17:18:33.791000+02:00","ids":[{"system_name":"GitLab Issue","text":"appsuite/support#763"}],"notes":[{"category":"description","text":"Malicious or unintentional API requests can be used to add significant amount of data to caches."}],"product_status":{"first_fixed":["OXAS-UIMIDDLEWARE_2.1.8"],"last_affected":["OXAS-UIMIDDLEWARE_2.1.7"]},"remediations":[{"category":"vendor_fix","date":"2025-08-12T12:51:34.862000+02:00","details":"Please deploy the provided updates and patch releases.","product_ids":["OXAS-UIMIDDLEWARE_2.1.7"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["OXAS-UIMIDDLEWARE_2.1.7"]}],"threats":[{"category":"impact","details":"Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component."},{"category":"exploit_status","details":"No publicly available exploits are known"}],"title":"Version information can be used to pollute caches and cause denial of service"}]}