1. Home
  2. CVE Database
  3. CVE-2023-41710
MEDIUM · 5.4

CVE-2023-41710

User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script...

Vulnerability Description

User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
Open-XchangeOx App Suite< 7.10.6

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2023-41710?

CVE-2023-41710 is a vulnerability with a CVSS score of 5.4 (MEDIUM). User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script...

How severe is CVE-2023-41710?

CVE-2023-41710 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-41710?

Check the references section above for vendor advisories and patch information. Affected products include: Open-Xchange Ox App Suite.