medium5.4
CVE-2020-24700
OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig.
Impact
OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Open-Xchange | Open-Xchange Appsuite | through 7.10.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
- http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2021/Jul/33
- https://www.open-xchange.com
- http://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
- http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2021/Jul/33
- https://www.open-xchange.com