← Retour aux CVEs

CVE-2023-41704

HIGH

7.1

Description

Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.

Details CVE

Score CVSS v3.17.1

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie2/12/2024

Derniere modification11/4/2025

Sourcenvd

Observations honeypot0

Produits affectes

open-xchange:open-xchange_appsuite

Faiblesses (CWE)

CWE-79CWE-79

References

https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json(security@open-xchange.com)

https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf(security@open-xchange.com)

http://seclists.org/fulldisclosure/2024/Feb/10(af854a3a-2127-422b-91ae-364da2661108)

https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json(af854a3a-2127-422b-91ae-364da2661108)

https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.