Open Xchange Ox App Suite

File Upload XSS: Malicious Content Triggers Script Execution in User Context
CVE-2025-59026 5.4 - Medium - November 27, 2025

Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known

XSS

Email XSS: Malicious Script Execution via Sanitization Bypass
CVE-2025-59025 6.1 - Medium - November 27, 2025

Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Sanitization has been updated to avoid such bypasses. No publicly available exploits are known

XSS

Office Doc Scripting Injection Vulnerability (CVE-2025-30190)
CVE-2025-30190 5.4 - Medium - November 27, 2025

Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known

XSS

CVE-2025-30186: File Upload XSS Causing Script Execution
CVE-2025-30186 5.4 - Medium - November 27, 2025

Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known

XSS

Unknown: EMail Redirection Attack via Malicious Content
CVE-2025-30191 5.4 - Medium - October 31, 2025

Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedure. No publicly available exploits are known

Clickjacking

Unknown: API-induced Cache Eviction DoS via Unbounded Data Addition
CVE-2025-30188 7.5 - High - October 31, 2025

Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component. Please deploy the provided updates and patch releases. No publicly available exploits are known

Resource Exhaustion

Remote Code Injection via Module Savepoints in Unknown Web CMS
CVE-2024-25582 5.4 - Medium - August 19, 2024

Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social engineering to make a user follow a prepared link to a malicious account. Please deploy the provided updates and patch releases. The savepoint module path has been restricted to modules that provide the feature, excluding any arbitrary or non-existing modules. No publicly available exploits are known.

XSS

Cross-User PDF Cache Disclosure in E-Mails Export
CVE-2024-23193 5.3 - Medium - May 06, 2024

E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters. Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions. No publicly available exploits are known.

Session Fixation

Outlook CIDBased Email Script Injection via Show More
CVE-2024-23187 6.1 - Medium - May 06, 2024

Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please deploy the provided updates and patch releases. CID replacement has been hardened to omit invalid identifiers. No publicly available exploits are known.

XSS

Apple Mail XSS via Malicious Email Display-Name (CVE-2024-23186)
CVE-2024-23186 6.1 - Medium - May 06, 2024

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.

XSS

RSS Feed data- Attribute Injection Vulnerability
CVE-2024-23192 6.1 - Medium - April 08, 2024

RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Potentially malicious attributes now get removed from external RSS content. No publicly available exploits are known.

XSS

Stored XSS via upsell ad content in user accounts
CVE-2024-23191 5.4 - Medium - April 08, 2024

Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known.

XSS

Upsell Component XSS: Manipulated Content Executes Script in Browser
CVE-2024-23190 5.4 - Medium - April 08, 2024

Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known.

XSS

Jira XSS via Embedded Content in Tasks
CVE-2024-23189 5.4 - Medium - April 08, 2024

Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to the users account, access to another account within the same context or an successful social engineering attack to make users import external content. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-generated content has been improved. No publicly available exploits are known.

XSS

Microsoft Outlook XSS via CID reference in EMail (CVE202341704)
CVE-2023-41704 7.1 - High - February 12, 2024

Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.

XSS

OX App Suite: Unrestricted DAV User-Agent Strings Causing DoS
CVE-2023-41705 6.5 - Medium - February 12, 2024

Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.

Resource Exhaustion

DoS via Unbounded Drive Search Expressions in OX App Suite
CVE-2023-41706 6.5 - Medium - February 12, 2024

Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited No publicly available exploits are known.

Resource Exhaustion

DoS via Unlimited Mail Search Expressions in OX App Suite
CVE-2023-41707 6.5 - Medium - February 12, 2024

Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.

Resource Exhaustion

CVE-2023-41708: App Loader redirect flaw enabling JS injection
CVE-2023-41708 5.4 - Medium - February 12, 2024

References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.

XSS

CVE-2023-41703: Confluence XSS via Unescaped User Mentions
CVE-2023-41703 6.1 - Medium - February 12, 2024

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.

XSS

XSS via Unsanitized Disclaimer Text in Upsell Shop Dialog
CVE-2023-29052 5.4 - Medium - January 08, 2024

Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.

XSS

Shopify: Unsanitized user script injection via upsell URL
CVE-2023-41710 5.4 - Medium - January 08, 2024

User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.

XSS

LDAP Filter Injection via LDAP Contacts Provider in Microsoft Skype for Business
CVE-2023-29050 9.6 - Critical - January 08, 2024

The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known.

Injection

OpenXchange OXMF Template Engine RCE via System Command Injection
CVE-2023-29048 8.8 - High - January 08, 2024

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.

Shell injection

OX App Suite: OXMF Template Feature Exposes Limited Internal Java API Access
CVE-2023-29051 8.1 - High - January 08, 2024

User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users and contexts. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product. No publicly available exploits are known.

Authorization

XSS via 'upsell' widget on portal page for code execution
CVE-2023-29049 6.1 - Medium - January 08, 2024

The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, could inject script code to gain persistent code execution capabilities under a trusted domain. User input for this widget is now sanitized to avoid malicious content the be processed. No publicly available exploits are known.

XSS

OX App Suite <7.10.6-rev37 Auth Bypass Read Contacts via AB Move
CVE-2023-24600 4.3 - Medium - May 29, 2023

OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book.

OX App Suite <7.10.6-rev37 INF Leak via Distribution Lists
CVE-2023-24598 4.3 - Medium - May 29, 2023

OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user.

OX App Suite 2FA Bypass before 7.10.6-rev37
CVE-2023-24605 4.2 - Medium - May 29, 2023

OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.

AuthZ

CVE-2023-24603 OX App Suite < 7.10.6-rev37: iCal size check flaw
CVE-2023-24603 6.5 - Medium - May 29, 2023

OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of data.

CVE-2023-24604 OX App Suite <7.10.6 Rev37 Unchecked HTTP Hdr Len in iCal
CVE-2023-24604 4.3 - Medium - May 29, 2023

OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of header data.

OX App Suite <7.10.6 rev37 ID Confusion Authenticated Appointment Modify
CVE-2023-24599 4.3 - Medium - May 29, 2023

OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion."

XSS via non-app deeplink in OX App Suite <7.10.6-rev24 jslob API
CVE-2023-24601 6.1 - Medium - May 29, 2023

OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.

XSS

XSS in OX App Suite <7.10.6-rev24 via Tumblr widget
CVE-2023-24602 6.1 - Medium - May 29, 2023

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title.

XSS

OX App Suite 7.10.6 Remote Resource Loading in Print (CVE-2023-24597)
CVE-2023-24597 5.3 - Medium - May 29, 2023

OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing.

[OX App Suite] XSS via Upsell Trigger prior to 7.10.6-rev30
CVE-2022-37306 6.1 - Medium - April 16, 2023

OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.

XSS

OX App Suite <7.10.6-rev30 SSRF via Email Account Discovery
CVE-2022-43699 4.3 - Medium - April 15, 2023

OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain (found in the host part of an e-mail address).

SSRF

XSS in OX App Suite <7.10.6 via Upsell Ads
CVE-2022-43696 6.1 - Medium - April 15, 2023

OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.

XSS

OX App Suite <7.10.6 XSS via jslob activity tracking adapter
CVE-2022-43697 6.1 - Medium - April 15, 2023

OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.

XSS

SSRF in OX App Suite <=7.10.6-rev30 via POP3 account change
CVE-2022-43698 4.3 - Medium - April 15, 2023

OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.

SSRF

OX App Suite <=7.10.6 XSS via Email-Only Contact
CVE-2022-37309 6.1 - Medium - December 26, 2022

OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.

XSS

XSS in OX App Suite <=8.2 via len/off in attachment/ox drive
CVE-2022-31468 6.1 - Medium - October 25, 2022

OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter.

XSS

OS Command Injection in OX App Suite 7.10.6 via Ghostscript EPSPDF
CVE-2022-29851 9.8 - Critical - October 25, 2022

documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document.

Shell injection

Ox App Suite <=7.10.6 SSRF via Predictable multipart Boundaries
CVE-2022-24406 6.5 - Medium - July 27, 2022

OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls.

Use of Insufficiently Random Values

OS Command Injection via Documentconverter in OX App Suite < 7.10.6
CVE-2022-23100 9.8 - Critical - July 27, 2022

OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).

Shell injection

XSS in OX App Suite <=7.10.6 via deep link (appHandler) in email
CVE-2022-23101 6.1 - Medium - July 27, 2022

OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.

XSS

OX App Suite <7.10.6 OS Command Injection Java serialized class to DocConv API
CVE-2022-24405 9.8 - Critical - July 27, 2022

OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.

Shell injection

OX App Suite through 7.10.5
CVE-2021-44212 6.1 - Medium - March 28, 2022

OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.

XSS

OX App Suite through 7.10.5
CVE-2021-44213 6.1 - Medium - March 28, 2022

OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.

XSS

OX App Suite through 7.10.5
CVE-2021-44211 5.4 - Medium - March 28, 2022

OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.

XSS