Read the docs
TI-2023-22122 Aliases CVE-2023-41703GHSA-7cxw-p58p-m7w4

Cross-site scripting in Open-Xchange GmbH OX App Suite

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00528 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Open-Xchange GmbHOX App Suiteup to 7.10.6-rev9; up to 8.19—No fix listedCNA
  • OX App Suite VendorOpen-Xchange GmbH Affected up to 7.10.6-rev9; up to 8.19 Fixed in — No fix listed CNA

CPE configurations NVD · 50

CPEVersionsRoleVendor
cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*before 7.10.6; after 7.10.6, before 8.20VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:-:*:*:*:*:*:*7.10.6VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6069:*:*:*:*:*:*7.10.6 patch_release_6069VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6073:*:*:*:*:*:*7.10.6 patch_release_6073VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6080:*:*:*:*:*:*7.10.6 patch_release_6080VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6085:*:*:*:*:*:*7.10.6 patch_release_6085VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6093:*:*:*:*:*:*7.10.6 patch_release_6093VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6102:*:*:*:*:*:*7.10.6 patch_release_6102VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6112:*:*:*:*:*:*7.10.6 patch_release_6112VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6121:*:*:*:*:*:*7.10.6 patch_release_6121VulnerableOpen-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:* Versions before 7.10.6; after 7.10.6, before 8.20 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:-:*:*:*:*:*:* Versions 7.10.6 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6069:*:*:*:*:*:* Versions 7.10.6 patch_release_6069 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6073:*:*:*:*:*:* Versions 7.10.6 patch_release_6073 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6080:*:*:*:*:*:* Versions 7.10.6 patch_release_6080 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6085:*:*:*:*:*:* Versions 7.10.6 patch_release_6085 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6093:*:*:*:*:*:* Versions 7.10.6 patch_release_6093 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6102:*:*:*:*:*:* Versions 7.10.6 patch_release_6102 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6112:*:*:*:*:*:* Versions 7.10.6 patch_release_6112 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6121:*:*:*:*:*:* Versions 7.10.6 patch_release_6121 Vulnerable ·Open-Xchange GmbH
Show 40 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6133:*:*:*:*:*:*7.10.6 patch_release_6133VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6138:*:*:*:*:*:*7.10.6 patch_release_6138VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6141:*:*:*:*:*:*7.10.6 patch_release_6141VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6146:*:*:*:*:*:*7.10.6 patch_release_6146VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6147:*:*:*:*:*:*7.10.6 patch_release_6147VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6148:*:*:*:*:*:*7.10.6 patch_release_6148VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6150:*:*:*:*:*:*7.10.6 patch_release_6150VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6156:*:*:*:*:*:*7.10.6 patch_release_6156VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6161:*:*:*:*:*:*7.10.6 patch_release_6161VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6166:*:*:*:*:*:*7.10.6 patch_release_6166VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6173:*:*:*:*:*:*7.10.6 patch_release_6173VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6176:*:*:*:*:*:*7.10.6 patch_release_6176VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6178:*:*:*:*:*:*7.10.6 patch_release_6178VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6189:*:*:*:*:*:*7.10.6 patch_release_6189VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6194:*:*:*:*:*:*7.10.6 patch_release_6194VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6199:*:*:*:*:*:*7.10.6 patch_release_6199VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6204:*:*:*:*:*:*7.10.6 patch_release_6204VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6205:*:*:*:*:*:*7.10.6 patch_release_6205VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6209:*:*:*:*:*:*7.10.6 patch_release_6209VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6210:*:*:*:*:*:*7.10.6 patch_release_6210VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6214:*:*:*:*:*:*7.10.6 patch_release_6214VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6215:*:*:*:*:*:*7.10.6 patch_release_6215VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6216:*:*:*:*:*:*7.10.6 patch_release_6216VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6218:*:*:*:*:*:*7.10.6 patch_release_6218VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6219:*:*:*:*:*:*7.10.6 patch_release_6219VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6220:*:*:*:*:*:*7.10.6 patch_release_6220VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6227:*:*:*:*:*:*7.10.6 patch_release_6227VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6230:*:*:*:*:*:*7.10.6 patch_release_6230VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6233:*:*:*:*:*:*7.10.6 patch_release_6233VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6235:*:*:*:*:*:*7.10.6 patch_release_6235VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6236:*:*:*:*:*:*7.10.6 patch_release_6236VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6239:*:*:*:*:*:*7.10.6 patch_release_6239VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6241:*:*:*:*:*:*7.10.6 patch_release_6241VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6243:*:*:*:*:*:*7.10.6 patch_release_6243VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6245:*:*:*:*:*:*7.10.6 patch_release_6245VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6248:*:*:*:*:*:*7.10.6 patch_release_6248VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6249:*:*:*:*:*:*7.10.6 patch_release_6249VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6250:*:*:*:*:*:*7.10.6 patch_release_6250VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6251:*:*:*:*:*:*7.10.6 patch_release_6251VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6255:*:*:*:*:*:*7.10.6 patch_release_6255VulnerableOpen-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6133:*:*:*:*:*:* Versions 7.10.6 patch_release_6133 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6138:*:*:*:*:*:* Versions 7.10.6 patch_release_6138 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6141:*:*:*:*:*:* Versions 7.10.6 patch_release_6141 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6146:*:*:*:*:*:* Versions 7.10.6 patch_release_6146 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6147:*:*:*:*:*:* Versions 7.10.6 patch_release_6147 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6148:*:*:*:*:*:* Versions 7.10.6 patch_release_6148 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6150:*:*:*:*:*:* Versions 7.10.6 patch_release_6150 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6156:*:*:*:*:*:* Versions 7.10.6 patch_release_6156 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6161:*:*:*:*:*:* Versions 7.10.6 patch_release_6161 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6166:*:*:*:*:*:* Versions 7.10.6 patch_release_6166 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6173:*:*:*:*:*:* Versions 7.10.6 patch_release_6173 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6176:*:*:*:*:*:* Versions 7.10.6 patch_release_6176 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6178:*:*:*:*:*:* Versions 7.10.6 patch_release_6178 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6189:*:*:*:*:*:* Versions 7.10.6 patch_release_6189 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6194:*:*:*:*:*:* Versions 7.10.6 patch_release_6194 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6199:*:*:*:*:*:* Versions 7.10.6 patch_release_6199 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6204:*:*:*:*:*:* Versions 7.10.6 patch_release_6204 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6205:*:*:*:*:*:* Versions 7.10.6 patch_release_6205 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6209:*:*:*:*:*:* Versions 7.10.6 patch_release_6209 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6210:*:*:*:*:*:* Versions 7.10.6 patch_release_6210 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6214:*:*:*:*:*:* Versions 7.10.6 patch_release_6214 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6215:*:*:*:*:*:* Versions 7.10.6 patch_release_6215 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6216:*:*:*:*:*:* Versions 7.10.6 patch_release_6216 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6218:*:*:*:*:*:* Versions 7.10.6 patch_release_6218 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6219:*:*:*:*:*:* Versions 7.10.6 patch_release_6219 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6220:*:*:*:*:*:* Versions 7.10.6 patch_release_6220 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6227:*:*:*:*:*:* Versions 7.10.6 patch_release_6227 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6230:*:*:*:*:*:* Versions 7.10.6 patch_release_6230 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6233:*:*:*:*:*:* Versions 7.10.6 patch_release_6233 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6235:*:*:*:*:*:* Versions 7.10.6 patch_release_6235 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6236:*:*:*:*:*:* Versions 7.10.6 patch_release_6236 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6239:*:*:*:*:*:* Versions 7.10.6 patch_release_6239 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6241:*:*:*:*:*:* Versions 7.10.6 patch_release_6241 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6243:*:*:*:*:*:* Versions 7.10.6 patch_release_6243 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6245:*:*:*:*:*:* Versions 7.10.6 patch_release_6245 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6248:*:*:*:*:*:* Versions 7.10.6 patch_release_6248 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6249:*:*:*:*:*:* Versions 7.10.6 patch_release_6249 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6250:*:*:*:*:*:* Versions 7.10.6 patch_release_6250 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6251:*:*:*:*:*:* Versions 7.10.6 patch_release_6251 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6255:*:*:*:*:*:* Versions 7.10.6 patch_release_6255 Vulnerable ·Open-Xchange GmbH

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Open-Xchange OX App Suite — documentation.open-xchange.com/appsuite/security/advisories…

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2023-22123 Cross-site scripting in Open-Xchange GmbH OX App SuitePriority LOW 32
    • TI-2023-22126 Uncontrolled resource consumption in Open-Xchange GmbH OX App SuitePriority LOW 30
    • TI-2023-22125 Uncontrolled resource consumption in Open-Xchange GmbH OX App SuitePriority LOW 30
    Show all 6 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-41703
  2. 2026-10-03 Alias added: GHSA-7cxw-p58p-m7w4

References

Advisory 2

  • TI-2022-17394 OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only… CVSS 3.1MEDIUM 5.3
  • TI-2022-17393 OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request… CVSS 3.1MEDIUM 5.3
  • TI-2022-17392 OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location… CVSS 3.1MEDIUM 5.3
  • TI-2022-17391 OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help… CVSS 3.1MEDIUM 6.1
  • TI-2022-17390 OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name. CVSS 3.1MEDIUM 6.1
  • TI-2022-17389 OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages. CVSS 3.1MEDIUM 6.1
See all 156 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences