CVE-2024-23190

{"id": "CVE-2024-23190", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@open-xchange.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-04-08T09:15:09.637", "references": [{"url": "https://documentation.open-xchange.com/appsuite/releases/8.21/", "source": "security@open-xchange.com"}, {"url": "https://documentation.open-xchange.com/appsuite/releases/8.22/", "source": "security@open-xchange.com"}, {"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json", "source": "security@open-xchange.com"}, {"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf", "source": "security@open-xchange.com"}, {"url": "http://seclists.org/fulldisclosure/2024/Apr/18", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://documentation.open-xchange.com/appsuite/releases/8.21/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://documentation.open-xchange.com/appsuite/releases/8.22/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@open-xchange.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known."}, {"lang": "es", "value": "La informaci\u00f3n de la tienda de ventas adicionales de una cuenta se puede manipular para ejecutar c\u00f3digo de script en el contexto de la sesi\u00f3n del navegador del usuario. Para aprovechar esto, un atacante necesitar\u00eda acceso temporal a la cuenta de un usuario o un ataque de ingenier\u00eda social exitoso para atraer a los usuarios a cuentas configuradas maliciosamente. Los atacantes podr\u00edan realizar solicitudes API maliciosas o extraer informaci\u00f3n de la cuenta del usuario. Implemente las actualizaciones y lanzamientos de parches proporcionados. Se ha mejorado la sanitizaci\u00f3n del contenido de ventas adicionales definido por el usuario. No se conocen exploits disponibles p\u00fablicamente."}], "lastModified": "2025-11-04T19:16:33.647", "sourceIdentifier": "security@open-xchange.com"}