CVE-2024-23189

Vulnerability

Overview CVE-2024-23189 is a stored cross-site scripting (XSS) vulnerability affecting Open-Xchange App Suite. The flaw exists in the handling of embedded content references within tasks. Due to improper sanitization of user-generated content, an attacker can inject malicious script code that executes in the context of the victim's browser session [2].

Exploitation

Conditions To exploit this vulnerability, an attacker must have temporary access to the victim's account, access to another account within the same context, or successfully trick the user into importing external content via social engineering [2]. Once the malicious content is processed, the script executes when the victim views the crafted task.

Impact

Upon successful exploitation, an attacker can perform malicious API requests on behalf of the user or extract sensitive information from the user's account, including potentially credentials or personal data [2]. The CVSS v3 base score is 5.4 (Medium), and the vulnerability is exploited with low complexity and low privileges required.

Mitigation

The vendor has released updates in App Suite 8.22 and 8.21, which improve sanitization of user-generated content [1][2]. Users are advised to deploy the provided patches. As of the advisory date, no publicly available exploits are known, but unpatched instances remain at risk.