{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-23190", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "state": "PUBLISHED", "assignerShortName": "OX", "dateReserved": "2024-01-12T07:03:12.862Z", "datePublished": "2024-04-08T08:09:12.210Z", "dateUpdated": "2025-11-04T18:23:44.547Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["frontend"], "product": "OX App Suite", "vendor": "Open-Xchange GmbH", "versions": [{"lessThanOrEqual": "7.10.6-rev40", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.6.3-rev54", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "cwe"}]}], "providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2024-04-25T15:09:25.858Z"}, "references": [{"tags": ["release-notes"], "url": "https://documentation.open-xchange.com/appsuite/releases/8.21/"}, {"tags": ["release-notes"], "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf"}, {"tags": ["release-notes"], "url": "https://documentation.open-xchange.com/appsuite/releases/8.22/"}, {"tags": ["vendor-advisory"], "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json"}], "source": {"defect": "OXUIB-2688", "discovery": "INTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23190", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-09T15:26:24.899915Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:22:36.922Z"}}, {"title": "CVE Program Container", "references": [{"tags": ["release-notes", "x_transferred"], "url": "https://documentation.open-xchange.com/appsuite/releases/8.21/"}, {"tags": ["release-notes", "x_transferred"], "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf"}, {"tags": ["release-notes", "x_transferred"], "url": "https://documentation.open-xchange.com/appsuite/releases/8.22/"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json"}, {"url": "http://seclists.org/fulldisclosure/2024/Apr/18"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T18:23:44.547Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://documentation.open-xchange.com/appsuite/releases/8.21/", "tags": ["release-notes", "x_transferred"]}, {"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf", "tags": ["release-notes", "x_transferred"]}, {"url": "https://documentation.open-xchange.com/appsuite/releases/8.22/", "tags": ["release-notes", "x_transferred"]}, {"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Apr/18"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T18:23:44.547Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23190", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-09T15:26:24.899915Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:43.300Z"}}], "cna": {"source": {"defect": "OXUIB-2688", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Open-Xchange GmbH", "modules": ["frontend"], "product": "OX App Suite", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.10.6-rev40"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.6.3-rev54"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://documentation.open-xchange.com/appsuite/releases/8.21/", "tags": ["release-notes"]}, {"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf", "tags": ["release-notes"]}, {"url": "https://documentation.open-xchange.com/appsuite/releases/8.22/", "tags": ["release-notes"]}, {"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2024-04-25T15:09:25.858Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23190", "state": "PUBLISHED", "dateUpdated": "2025-11-04T18:23:44.547Z", "dateReserved": "2024-01-12T07:03:12.862Z", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "datePublished": "2024-04-08T08:09:12.210Z", "assignerShortName": "OX"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known."}, {"lang": "es", "value": "La informaci\u00f3n de la tienda de ventas adicionales de una cuenta se puede manipular para ejecutar c\u00f3digo de script en el contexto de la sesi\u00f3n del navegador del usuario. Para aprovechar esto, un atacante necesitar\u00eda acceso temporal a la cuenta de un usuario o un ataque de ingenier\u00eda social exitoso para atraer a los usuarios a cuentas configuradas maliciosamente. Los atacantes podr\u00edan realizar solicitudes API maliciosas o extraer informaci\u00f3n de la cuenta del usuario. Implemente las actualizaciones y lanzamientos de parches proporcionados. Se ha mejorado la sanitizaci\u00f3n del contenido de ventas adicionales definido por el usuario. No se conocen exploits disponibles p\u00fablicamente."}], "id": "CVE-2024-23190", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security@open-xchange.com", "type": "Secondary"}]}, "published": "2024-04-08T09:15:09.637", "references": [{"source": "security@open-xchange.com", "url": "https://documentation.open-xchange.com/appsuite/releases/8.21/"}, {"source": "security@open-xchange.com", "url": "https://documentation.open-xchange.com/appsuite/releases/8.22/"}, {"source": "security@open-xchange.com", "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json"}, {"source": "security@open-xchange.com", "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2024/Apr/18"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://documentation.open-xchange.com/appsuite/releases/8.21/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://documentation.open-xchange.com/appsuite/releases/8.22/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf"}], "sourceIdentifier": "security@open-xchange.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@open-xchange.com", "type": "Secondary"}]}

{}

{}