Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize jslob content for those locations to avoid redirects to malicious content. No publicly available exploits are known.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Open-xchange |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-30268 | Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize jslob content for those locations to avoid redirects to malicious content. No publicly available exploits are known. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: OX
Published:
Updated: 2024-08-02T11:46:24.702Z
Reserved: 2023-02-22T20:42:56.091Z
Link: CVE-2023-26448
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-08-02T13:15:11.017
Modified: 2024-11-21T07:51:28.737
Link: CVE-2023-26448
Redhat
No data.
OpenCVE Enrichment
No data.