CVE-2024-23186
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices.
Does this matter?
Lower severity and a low EPSS score (0.57%). Track it; it rarely justifies an emergency change on its own.
Description
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.57% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- open-xchange/ox app suite
- Source
- security@open-xchange.com
References
- http://seclists.org/fulldisclosure/2024/May/3Mailing List, Third Party Advisory
- https://documentation.open-xchange.com/appsuite/releases/8.22/Release Notes
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.jsonIssue Tracking, Vendor Advisory
- http://seclists.org/fulldisclosure/2024/May/3Mailing List, Third Party Advisory
- https://documentation.open-xchange.com/appsuite/releases/8.22/Release Notes
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.jsonIssue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.