Описание
Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentially break the exported data structure. We now drop all control characters that are not whitespace character during the export. No publicly available exploits are known.
Ссылки
- Third Party AdvisoryVDB Entry
- Mailing ListThird Party Advisory
- Release Notes
- Third Party AdvisoryVDB Entry
- Mailing ListThird Party Advisory
- Release Notes
Уязвимые конфигурации
Конфигурация 1Версия до 7.10.6 (исключая)Версия от 8.0.0 (включая) до 8.11.0 (исключая)
Одно из
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:*:*:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:*:*:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:*:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:revision_39:*:*:*:*:*:*
EPSS
Процентиль: 34%
0.00135
Низкий
3.5 Low
CVSS3
5.3 Medium
CVSS3
Дефекты
CWE-77
CWE-77
Связанные уязвимости
CVSS3: 3.5
github
больше 2 лет назад
Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentially break the exported data structure. We now drop all control characters that are not whitespace character during the export. No publicly available exploits are known.
EPSS
Процентиль: 34%
0.00135
Низкий
3.5 Low
CVSS3
5.3 Medium
CVSS3
Дефекты
CWE-77
CWE-77