high7.1
CVE-2023-41704
Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine.
Impact
Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Open-Xchange | Open-Xchange Appsuite | before 7.6.3 after 7.6.3 before 7.10.6 after 7.10.6 before 8.20 Versions 7.6.3, 7.10.6 |
Weakness classification
References
- NVD record
- CVE.org record
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf
- http://seclists.org/fulldisclosure/2024/Feb/10
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf