CVE-2023-26456: Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface…

PriorityP427medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.38%

30.2th percentile

Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. Sanitization is in place for product names now. No publicly available exploits are known.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
open-xchange	ox_guard	< 2.10.7	2.10.7
open-xchange	ox_guard	—	—
ox_software_gmbh	ox_app_suite	<= 2.10.7-rev6	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.