CVE-2024-23190

CVE-2024-23190 describes a stored cross-site scripting (XSS) vulnerability in the Open-Xchange App Suite. The root cause lies in insufficient sanitization of user-defined upsell shop content, allowing an attacker to inject arbitrary script code into the context of a victim's browser session [1][2].

Exploitation requires temporary access to a target user's account or a successful social engineering attack that lures a user to interact with a maliciously configured account. Because the injected script executes in the user's browser, an attacker can perform malicious API requests on behalf of the victim or extract sensitive information from the user's account [1][2].

The impact is limited to the victim's session but can lead to unauthorized actions and data disclosure. The vendor has addressed the issue by improving input sanitization in App Suite releases 8.21 and 8.22. Patches are available and administrators are advised to deploy the updates to mitigate the risk [1][2].