OXAS-ADV-2025-0001: OX App Suite Security Advisory

[Martin Heiland via Fulldisclosure <fulldisclosure () seclists org>]

Dear subscribers,

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those 
vulnerabilities. Feel free to join our bug bounty programs for OX App Suite, Dovecot and PowerDNS at YesWeHack.

This advisory has also been published at 
https://documentation.open-xchange.com/appsuite/security/advisories/html/2025/oxas-adv-2025-0001.html.

Yours sincerely,
  Martin Heiland, Open-Xchange GmbH



Classification: TLP:GREEN

Internal reference: appsuite/web-apps/ui#785
Type: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Component: frontend
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite frontend 7.10.6-rev49
First fixed revision: OX App Suite frontend 7.10.6-rev50
Discovery date: 2024-12-13
Solution date: 2025-01-08
Disclosure date: 2025-01-27
CVE: CVE-2024-47875
CVSS: 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H)

Details:
Vulnerable DOMPurify shipped with App Suite 7.10.6 and 7.6.3. The DOMPurify third-party library has been updated to 
resolve known vulnerabilities.

Risk:
This is done as a precautionary measure, at this time none of the related vulnerabilities is known to be exploitable in 
context of OX App Suite. No publicly available exploits are known.

Solution:
Third-party libraries have been updated.



---



Internal reference: DOCS-5081
Type: CWE-611 (Improper Restriction of XML External Entity Reference)
Component: office
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite office 7.10.6-rev15
First fixed revision: OX App Suite office 7.10.6-rev16
Discovery date: 2023-09-12
Solution date: 2024-12-03
Disclosure date: 2025-01-27
CVE: CVE-2022-0839
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Details:
Resolving third-party vulnerabilities in the office master (7.10.6) repo. Several third-party libraries have been 
updated to resolve known vulnerabilities. This includes H2, Xalan, Liquibase and Spring Boot.

Risk:
This is done as a precautionary measure, at this time none of the related vulnerabilities is known to be exploitable in 
context of OX App Suite. No publicly available exploits are known.

Solution:
Third-party libraries have been updated.



---



Internal reference: DOCS-5338
Type: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Component: office
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite office 7.10.6-rev11
First fixed revision: OX App Suite office 7.10.6-rev12
Discovery date: 2024-12-12
Solution date: 2025-01-27
Disclosure date: 2025-01-27
CVE: CVE-2021-23358
CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Details:
Resolving third-party vulnerabilities in the office-ui master (7.10.6) repo. Several third-party libraries have been 
updated to resolve known vulnerabilities. This includes grunt, dompurify, codecept, underscore and requirejs.

Risk:
This is done as a precautionary measure, at this time none of the related vulnerabilities is known to be exploitable in 
context of OX App Suite. No publicly available exploits are known.

Solution:
Third-party libraries have been updated.

Attachment: signature.asc
Description:

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/