What’s Vulnerable › Vulnerabilities

CVE-2024-23186

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-06 · updated 2026-06-17
• Weakness: CWE-79

Description

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.

Affected products

• Open-Xchange GmbH OX App Suite: before 8.22 — fixed in 8.22

How to fix

Upgrade to a fixed version: Open-Xchange GmbH OX App Suite 8.22. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2024/May/3
• https://documentation.open-xchange.com/appsuite/releases/8.22/
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json
• http://seclists.org/fulldisclosure/2024/May/3
• https://documentation.open-xchange.com/appsuite/releases/8.22/
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json

Get alerted when CVE-2024-23186 or the next vulnerability affects your stack