Description
Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize the theme value and use a default fallback if no theme matches. No publicly available exploits are known.

Published: 2023-08-02
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-30265 Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize the theme value and use a default fallback if no theme matches. No publicly available exploits are known.
History

No history.

Subscriptions

Open-xchange Open-xchange Appsuite Frontend
cve-icon MITRE

Status: PUBLISHED

Assigner: OX

Published:

Updated: 2024-08-02T11:46:24.637Z

Reserved: 2023-02-22T20:42:56.091Z

Link: CVE-2023-26445

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-08-02T13:15:10.797

Modified: 2026-06-17T05:43:20.970

Link: CVE-2023-26445

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')