cve-2024-23186
Vulnerability from cvelistv5
Published
2024-05-06 06:36
Modified
2025-02-13 17:33
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS score ?
0.69% (0.69477)
Summary
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.
References
security@open-xchange.comhttp://seclists.org/fulldisclosure/2024/May/3Mailing List, Third Party Advisory
security@open-xchange.comhttps://documentation.open-xchange.com/appsuite/releases/8.22/Release Notes
security@open-xchange.comhttps://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.jsonIssue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2024/May/3Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://documentation.open-xchange.com/appsuite/releases/8.22/Release Notes
af854a3a-2127-422b-91ae-364da2661108https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.jsonIssue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
Open-Xchange GmbH OX App Suite Version: 0   ≤ 8.21
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "ox_app_suite",
                  vendor: "open-xchange",
                  versions: [
                     {
                        status: "affected",
                        version: "*",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-23186",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-05-06T16:02:20.364496Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:45:38.374Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-01T22:59:32.072Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "release-notes",
                     "x_transferred",
                  ],
                  url: "https://documentation.open-xchange.com/appsuite/releases/8.22/",
               },
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2024/May/3",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               modules: [
                  "frontend",
               ],
               product: "OX App Suite",
               vendor: "Open-Xchange GmbH",
               versions: [
                  {
                     lessThanOrEqual: "8.21",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-79",
                     description: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                     lang: "en",
                     type: "cwe",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-05-07T00:06:00.969Z",
            orgId: "8ce71d90-2354-404b-a86e-bec2cc4e6981",
            shortName: "OX",
         },
         references: [
            {
               tags: [
                  "release-notes",
               ],
               url: "https://documentation.open-xchange.com/appsuite/releases/8.22/",
            },
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json",
            },
            {
               url: "http://seclists.org/fulldisclosure/2024/May/3",
            },
         ],
         source: {
            defect: "OXUIB-2735",
            discovery: "INTERNAL",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8ce71d90-2354-404b-a86e-bec2cc4e6981",
      assignerShortName: "OX",
      cveId: "CVE-2024-23186",
      datePublished: "2024-05-06T06:36:38.440Z",
      dateReserved: "2024-01-12T07:03:12.862Z",
      dateUpdated: "2025-02-13T17:33:46.948Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-23186\",\"sourceIdentifier\":\"security@open-xchange.com\",\"published\":\"2024-05-06T07:15:06.450\",\"lastModified\":\"2025-03-05T18:25:53.837\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.\"},{\"lang\":\"es\",\"value\":\"El correo electrónico que contiene información maliciosa sobre el nombre para mostrar podría desencadenar la ejecución de un script del lado del cliente cuando se utilizan dispositivos móviles específicos. Los atacantes podrían realizar solicitudes API maliciosas o extraer información de la cuenta del usuario. Implemente las actualizaciones y lanzamientos de parches proporcionados. Ahora utilizamos métodos más seguros para manejar contenido externo al incorporar información del nombre para mostrar en la interfaz web. No se conocen exploits disponibles públicamente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@open-xchange.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security@open-xchange.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.22\",\"matchCriteriaId\":\"7554B880-74F3-4579-877E-E0E0DB12765B\"}]}]}],\"references\":[{\"url\":\"http://seclists.org/fulldisclosure/2024/May/3\",\"source\":\"security@open-xchange.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://documentation.open-xchange.com/appsuite/releases/8.22/\",\"source\":\"security@open-xchange.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json\",\"source\":\"security@open-xchange.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2024/May/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://documentation.open-xchange.com/appsuite/releases/8.22/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://documentation.open-xchange.com/appsuite/releases/8.22/\", \"tags\": [\"release-notes\", \"x_transferred\"]}, {\"url\": \"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2024/May/3\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T22:59:32.072Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-23186\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-06T16:02:20.364496Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:*\"], \"vendor\": \"open-xchange\", \"product\": \"ox_app_suite\", \"versions\": [{\"status\": \"affected\", \"version\": \"*\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-06T16:05:44.419Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"source\": {\"defect\": \"OXUIB-2735\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Open-Xchange GmbH\", \"modules\": [\"frontend\"], \"product\": \"OX App Suite\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.21\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://documentation.open-xchange.com/appsuite/releases/8.22/\", \"tags\": [\"release-notes\"]}, {\"url\": \"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2024/May/3\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-79\", \"description\": \"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\"}]}], \"providerMetadata\": {\"orgId\": \"8ce71d90-2354-404b-a86e-bec2cc4e6981\", \"shortName\": \"OX\", \"dateUpdated\": \"2024-05-06T06:36:38.440Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-23186\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T22:59:32.072Z\", \"dateReserved\": \"2024-01-12T07:03:12.862Z\", \"assignerOrgId\": \"8ce71d90-2354-404b-a86e-bec2cc4e6981\", \"datePublished\": \"2024-05-06T06:36:38.440Z\", \"assignerShortName\": \"OX\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.