Read the docs
TI-2023-10217 Aliases CVE-2023-24601GHSA-cqj2-j35m-r4vg

OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 25

CPEVersionsRoleVendor
cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:*before 7.10.6VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:*7.10.6VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev01:*:*:*:*:*:*7.10.6 rev01VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev02:*:*:*:*:*:*7.10.6 rev02VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev03:*:*:*:*:*:*7.10.6 rev03VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev04:*:*:*:*:*:*7.10.6 rev04VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev05:*:*:*:*:*:*7.10.6 rev05VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev06:*:*:*:*:*:*7.10.6 rev06VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev07:*:*:*:*:*:*7.10.6 rev07VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev08:*:*:*:*:*:*7.10.6 rev08VulnerableOpen-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:* Versions before 7.10.6 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:* Versions 7.10.6 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev01:*:*:*:*:*:* Versions 7.10.6 rev01 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev02:*:*:*:*:*:* Versions 7.10.6 rev02 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev03:*:*:*:*:*:* Versions 7.10.6 rev03 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev04:*:*:*:*:*:* Versions 7.10.6 rev04 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev05:*:*:*:*:*:* Versions 7.10.6 rev05 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev06:*:*:*:*:*:* Versions 7.10.6 rev06 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev07:*:*:*:*:*:* Versions 7.10.6 rev07 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev08:*:*:*:*:*:* Versions 7.10.6 rev08 Vulnerable ·Open-Xchange GmbH
Show 15 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev09:*:*:*:*:*:*7.10.6 rev09VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:*7.10.6 rev10VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:*7.10.6 rev11VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:*7.10.6 rev12VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:*7.10.6 rev13VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:*7.10.6 rev14VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:*7.10.6 rev15VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:*7.10.6 rev16VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:*7.10.6 rev17VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:*7.10.6 rev18VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:*7.10.6 rev19VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:*7.10.6 rev20VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:*7.10.6 rev21VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:*7.10.6 rev22VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:*7.10.6 rev23VulnerableOpen-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev09:*:*:*:*:*:* Versions 7.10.6 rev09 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:* Versions 7.10.6 rev10 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:* Versions 7.10.6 rev11 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:* Versions 7.10.6 rev12 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:* Versions 7.10.6 rev13 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:* Versions 7.10.6 rev14 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:* Versions 7.10.6 rev15 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:* Versions 7.10.6 rev16 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:* Versions 7.10.6 rev17 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:* Versions 7.10.6 rev18 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:* Versions 7.10.6 rev19 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:* Versions 7.10.6 rev20 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:* Versions 7.10.6 rev21 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:* Versions 7.10.6 rev22 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:* Versions 7.10.6 rev23 Vulnerable ·Open-Xchange GmbH

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-24601
  2. 2026-10-03 Alias added: GHSA-cqj2-j35m-r4vg

References

Advisory 1

Other 1

  • TI-2022-17387 OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger. CVSS 3.1MEDIUM 6.1
  • TI-2022-12211 documentconverter in OX App Suite through 7.10.6, in a non-default configuration with… CVSS 3.1CRITICAL 9.8
  • TI-2022-08281 OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API. CVSS 3.1CRITICAL 9.8
  • TI-2022-07269 OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). CVSS 3.1CRITICAL 9.8
  • TI-2023-13500 LDAP injection in Open-Xchange GmbH OX App Suite CVSS 3.1CRITICAL 9.6
  • TI-2023-13498 OS command injection in Open-Xchange GmbH OX App Suite CVSS 3.1HIGH 8.8
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences