CVE-2024-23192

The vulnerability lies in the handling of RSS feeds within Open-Xchange App Suite. Malicious data- attributes can be embedded in RSS content, which are not properly sanitized before rendering. This allows an attacker to inject arbitrary script code into the user's browser session when the feed is read [1][2].

An attacker can exploit this by hosting a compromised RSS feed or tricking a user into accessing a malicious account. No authentication is required beyond user interaction; simply viewing the feed triggers the payload. The attack surface is the RSS reader component in the application.

Successful exploitation leads to script execution in the context of the user's session. The attacker could perform malicious API requests on behalf of the user, exfiltrate sensitive information from their account, or perform other unauthorized actions. The vulnerability is classified as medium severity with a CVSS score of 6.1.

Open-Xchange has released patches in versions 8.22 and 8.21 that remove potentially malicious data- attributes from external RSS content. Users are advised to update to these or later versions. As of publication, no public exploits are known.