Dear subscribers,
We're sharing our latest advisory with you and like to thank everyone who
contributed in finding and solving those vulnerabilities. Feel free to join our
bug bounty programs for OX App Suite, Dovecot and PowerDNS at YesWeHack.
This advisory has also been published at
https://documentation.open-xchange.com/appsuite/security/advisories/html/2024/oxas-adv-2024-0003.html.
Yours sincerely,
Martin Heiland, Open-Xchange GmbH
Internal reference: MWB-2525
Type: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Component: backend
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite backend 7.10.6-rev61, OX App Suite backend
8.22
First fixed revision: OX App Suite backend 7.10.6-rev62, OX App Suite backend
8.23
Discovery date: 2024-03-01
Solution date: 2024-04-11
CVE: CVE-2024-25710
CVSS: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Details:
Apache Commons Compress library is prone to a denial of service (DoS)
vulnerability.. Loop with Unreachable Exit Condition ('Infinite Loop')
vulnerability in Apache Commons Compress. This issue affects a Apache Commons
Compress library shipped with OX App Suite.
Risk:
The vulnerability can potentially be exploited through OX App Suite and affect
availability of the service. No publicly available exploits are known.
Solution:
Please deploy the provided updates and patch releases. We have updated the
vulnerable library as a precaution to avoid potential exploitation.
---
Internal reference: OXUIB-2718
Type: CWE-79 (Improper Neutralization of Input During Web Page Generation
('Cross-site Scripting'))
Component: frontend
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite frontend 7.10.6-rev42
First fixed revision: OX App Suite frontend 7.10.6-rev43
Discovery date: 2024-01-30
Solution date: 2024-04-04
CVE: CVE-2024-25582
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Details:
XSS using arbitrary relative path to UI module. Module savepoints could be
abused to inject references to malicious code delivered through the same domain.
Risk:
Attackers could perform malicious API requests or extract information from the
users account. Exploiting this vulnerability requires temporary access to an
account or successful social engineering to make a user follow a prepared link
to a malicious account. No publicly available exploits are known.
Solution:
Please deploy the provided updates and patch releases. The savepoint module
path has been restricted to modules that provide the feature, excluding any
arbitrary or non-existing modules.
---
Internal reference: OXUIB-2699
Type: CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page
(Basic XSS))
Component: frontend
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite frontend 7.10.6-rev42
First fixed revision: OX App Suite frontend 7.10.6-rev43
Discovery date: 2024-01-15
Solution date: 2024-03-28
CVE: CVE-2021-41184
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Details:
Outdated jquery-ui shipped with 7.10.6. JQuery third-party components with
known vulnerabilities have been shipped.
Risk:
This update serves as a preventive measure since no practical exploitation in
the context of OX App Suite is feasible. No publicly available exploits are
known.
Solution:
Please deploy the provided updates and patch releases. The relevant components
have been updated to mitigate potential exploitation.
Attachment:
signature.asc
Description: PGP signature
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/