What’s Vulnerable › Vulnerabilities

CVE-2024-23187

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-06 · updated 2026-06-17
• Weakness: CWE-79

Description

Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please deploy the provided updates and patch releases. CID replacement has been hardened to omit invalid identifiers. No publicly available exploits are known.

Affected products

• Open-Xchange GmbH OX App Suite: before 8.22 — fixed in 8.22

How to fix

Upgrade to a fixed version: Open-Xchange GmbH OX App Suite 8.22. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2024/May/3
• https://documentation.open-xchange.com/appsuite/releases/8.22/
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json
• http://seclists.org/fulldisclosure/2024/May/3
• https://documentation.open-xchange.com/appsuite/releases/8.22/
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json

Get alerted when CVE-2024-23187 or the next vulnerability affects your stack