Vulnerability CVE-2021-33493
Published: 2021-11-22

Description:
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.

Type:

CWE-94

 (Improper Control of Generation of Code ('Code Injection'))

CVSS2 => (AV:L/AC:L/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.6/10
4.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial
Affected software
Open-xchange -> Ox app suite 

 References:
https://open-xchange.com
https://seclists.org/fulldisclosure/2021/Nov/42
http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html
Copyright 2024, cxsecurity.com

 

Back to Top