6.1

CVE-2021-37402

OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update -
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update patch_release5547
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update patch_release5572
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update patch_release5623
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update patch_release5653
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update patch_release5677
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update patch_release5720
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev1
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev10
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev11
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev12
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev13
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev14
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev15
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev16
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev17
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev18
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev19
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev2
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev20
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev21
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev22
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev23
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev24
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev25
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev26
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev27
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev28
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev29
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev3
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev30
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev31
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev4
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev5
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev6
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev7
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev8
Open-xchange ≫ Open-xchange Appsuite Version 7.10.3 Update rev9
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update -
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev1
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev10
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev11
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev12
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev13
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev14
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev15
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev16
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev17
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev2
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev3
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev4
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev5
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev6
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev7
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev8
Open-xchange ≫ Open-xchange Appsuite Version 7.10.4 Update rev9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.79% 0.515
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://seclists.org/fulldisclosure/2021/Jul/33
Third Party Advisory
Mailing List
https://www.open-xchange.com
Vendor Advisory