Read the docs
TI-2023-10220 Aliases CVE-2023-24604GHSA-x7c9-rh33-jx9h

OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when…

Priority LOW 21Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of header data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00673 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:*before 7.10.6VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:*7.10.6VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev01:*:*:*:*:*:*7.10.6 rev01VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev02:*:*:*:*:*:*7.10.6 rev02VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev03:*:*:*:*:*:*7.10.6 rev03VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev04:*:*:*:*:*:*7.10.6 rev04VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev05:*:*:*:*:*:*7.10.6 rev05VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev06:*:*:*:*:*:*7.10.6 rev06VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev07:*:*:*:*:*:*7.10.6 rev07VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev08:*:*:*:*:*:*7.10.6 rev08VulnerableOpen-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:* Versions before 7.10.6 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:* Versions 7.10.6 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev01:*:*:*:*:*:* Versions 7.10.6 rev01 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev02:*:*:*:*:*:* Versions 7.10.6 rev02 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev03:*:*:*:*:*:* Versions 7.10.6 rev03 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev04:*:*:*:*:*:* Versions 7.10.6 rev04 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev05:*:*:*:*:*:* Versions 7.10.6 rev05 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev06:*:*:*:*:*:* Versions 7.10.6 rev06 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev07:*:*:*:*:*:* Versions 7.10.6 rev07 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev08:*:*:*:*:*:* Versions 7.10.6 rev08 Vulnerable ·Open-Xchange GmbH
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev09:*:*:*:*:*:*7.10.6 rev09VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:*7.10.6 rev10VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:*7.10.6 rev11VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:*7.10.6 rev12VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:*7.10.6 rev13VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:*7.10.6 rev14VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:*7.10.6 rev15VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:*7.10.6 rev16VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:*7.10.6 rev17VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:*7.10.6 rev18VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:*7.10.6 rev19VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:*7.10.6 rev20VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:*7.10.6 rev21VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:*7.10.6 rev22VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:*7.10.6 rev23VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev24:*:*:*:*:*:*7.10.6 rev24VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev25:*:*:*:*:*:*7.10.6 rev25VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev26:*:*:*:*:*:*7.10.6 rev26VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev27:*:*:*:*:*:*7.10.6 rev27VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev28:*:*:*:*:*:*7.10.6 rev28VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev29:*:*:*:*:*:*7.10.6 rev29VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev30:*:*:*:*:*:*7.10.6 rev30VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev31:*:*:*:*:*:*7.10.6 rev31VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev32:*:*:*:*:*:*7.10.6 rev32VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev33:*:*:*:*:*:*7.10.6 rev33VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev34:*:*:*:*:*:*7.10.6 rev34VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev35:*:*:*:*:*:*7.10.6 rev35VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev36:*:*:*:*:*:*7.10.6 rev36VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev37:*:*:*:*:*:*7.10.6 rev37VulnerableOpen-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev09:*:*:*:*:*:* Versions 7.10.6 rev09 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:* Versions 7.10.6 rev10 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:* Versions 7.10.6 rev11 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:* Versions 7.10.6 rev12 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:* Versions 7.10.6 rev13 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:* Versions 7.10.6 rev14 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:* Versions 7.10.6 rev15 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:* Versions 7.10.6 rev16 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:* Versions 7.10.6 rev17 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:* Versions 7.10.6 rev18 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:* Versions 7.10.6 rev19 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:* Versions 7.10.6 rev20 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:* Versions 7.10.6 rev21 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:* Versions 7.10.6 rev22 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:* Versions 7.10.6 rev23 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev24:*:*:*:*:*:* Versions 7.10.6 rev24 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev25:*:*:*:*:*:* Versions 7.10.6 rev25 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev26:*:*:*:*:*:* Versions 7.10.6 rev26 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev27:*:*:*:*:*:* Versions 7.10.6 rev27 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev28:*:*:*:*:*:* Versions 7.10.6 rev28 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev29:*:*:*:*:*:* Versions 7.10.6 rev29 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev30:*:*:*:*:*:* Versions 7.10.6 rev30 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev31:*:*:*:*:*:* Versions 7.10.6 rev31 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev32:*:*:*:*:*:* Versions 7.10.6 rev32 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev33:*:*:*:*:*:* Versions 7.10.6 rev33 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev34:*:*:*:*:*:* Versions 7.10.6 rev34 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev35:*:*:*:*:*:* Versions 7.10.6 rev35 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev36:*:*:*:*:*:* Versions 7.10.6 rev36 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev37:*:*:*:*:*:* Versions 7.10.6 rev37 Vulnerable ·Open-Xchange GmbH

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-24604
  2. 2026-10-03 Alias added: GHSA-x7c9-rh33-jx9h

References

Advisory 1

Other 1

  • TI-2022-17387 OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger. CVSS 3.1MEDIUM 6.1
  • TI-2022-12211 documentconverter in OX App Suite through 7.10.6, in a non-default configuration with… CVSS 3.1CRITICAL 9.8
  • TI-2022-08281 OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API. CVSS 3.1CRITICAL 9.8
  • TI-2022-07269 OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). CVSS 3.1CRITICAL 9.8
  • TI-2023-13500 LDAP injection in Open-Xchange GmbH OX App Suite CVSS 3.1CRITICAL 9.6
  • TI-2023-13498 OS command injection in Open-Xchange GmbH OX App Suite CVSS 3.1HIGH 8.8
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences