VulnerabilityAnalyzed
CVE-2024-23187
Attackers could perform malicious API requests or extract information from the users account.
MEDIUM 6.1EPSS 0.48%
Does this matter?
Lower severity and a low EPSS score (0.48%). Track it; it rarely justifies an emergency change on its own.
Description
Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please deploy the provided updates and patch releases. CID replacement has been hardened to omit invalid identifiers. No publicly available exploits are known.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.48% probability · 40th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- open-xchange/ox app suite
- Source
- security@open-xchange.com
References
- http://seclists.org/fulldisclosure/2024/May/3Mailing List, Third Party Advisory
- https://documentation.open-xchange.com/appsuite/releases/8.22/Release Notes
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.jsonIssue Tracking, Vendor Advisory
- http://seclists.org/fulldisclosure/2024/May/3Mailing List, Third Party Advisory
- https://documentation.open-xchange.com/appsuite/releases/8.22/Release Notes
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.jsonIssue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.