CVE-2022-43697

Published: Apr 15, 2023Modified: Feb 6, 2025

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.

Affected (31)

Products: Open Xchange: Ox App Suite

1 product

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Open Xchange Ox App Suite	Before 7.10.6
Open Xchange Ox App Suite	Version 7.10.6
Open Xchange Ox App Suite	Version 7.10.6 rev01
Open Xchange Ox App Suite	Version 7.10.6 rev02
Open Xchange Ox App Suite	Version 7.10.6 rev03
Open Xchange Ox App Suite	Version 7.10.6 rev04
Open Xchange Ox App Suite	Version 7.10.6 rev05
Open Xchange Ox App Suite	Version 7.10.6 rev06
Open Xchange Ox App Suite	Version 7.10.6 rev07
Open Xchange Ox App Suite	Version 7.10.6 rev08
Open Xchange Ox App Suite	Version 7.10.6 rev09
Open Xchange Ox App Suite	Version 7.10.6 rev10
Open Xchange Ox App Suite	Version 7.10.6 rev11
Open Xchange Ox App Suite	Version 7.10.6 rev12
Open Xchange Ox App Suite	Version 7.10.6 rev13
Open Xchange Ox App Suite	Version 7.10.6 rev14
Open Xchange Ox App Suite	Version 7.10.6 rev15
Open Xchange Ox App Suite	Version 7.10.6 rev16
Open Xchange Ox App Suite	Version 7.10.6 rev17
Open Xchange Ox App Suite	Version 7.10.6 rev18
Open Xchange Ox App Suite	Version 7.10.6 rev19
Open Xchange Ox App Suite	Version 7.10.6 rev20
Open Xchange Ox App Suite	Version 7.10.6 rev21
Open Xchange Ox App Suite	Version 7.10.6 rev22
Open Xchange Ox App Suite	Version 7.10.6 rev23
Open Xchange Ox App Suite	Version 7.10.6 rev24
Open Xchange Ox App Suite	Version 7.10.6 rev25
Open Xchange Ox App Suite	Version 7.10.6 rev26
Open Xchange Ox App Suite	Version 7.10.6 rev27
Open Xchange Ox App Suite	Version 7.10.6 rev28
Open Xchange Ox App Suite	Version 7.10.6 rev29

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://open-xchange.com

Source: cve@mitre.org

Product

https://seclists.org/fulldisclosure/2023/Feb/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://open-xchange.com

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://seclists.org/fulldisclosure/2023/Feb/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.