Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2020-24701 — Cross-site Scripting in Appsuite

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
25.3%
top 3.79%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Open-xchange Appsuite
Timeline
PublishedJan 12
Latest updateMay 24

Description

OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-hxc8-899q-wp57: OX App Suite through 7↗2022-05-24
▶
CVEList
CVE-2020-24701: OX App Suite through 7↗2021-01-12
▶

💥Exploits & PoCs

1
Nuclei
OX Appsuite - Cross-Site Scripting
▶

🕵️Threat Intelligence

1
Greynoiseio
NoiseLetter October 2025↗
▶
CVE-2020-24701 — Cross-site Scripting in Appsuite | cvebase