Unrated
Security advisory
OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-24598
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 16:30 UTC · Revision 1
Source evidence
OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user.
osv:CVE-2023-24598
Complete source record
{
"id": "944681d68b8fe1b5e229da3bef8643f712e1f530f84c721e3c40410d3bd77c7c",
"url": "https://osv.dev/vulnerability/CVE-2023-24598",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2023-24598",
"summary": "OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user.",
"evidence": "osv:CVE-2023-24598",
"products": [],
"severity": "unknown",
"structured": {
"id": "CVE-2023-24598",
"aliases": [
"CVE-2023-24598"
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/open-xchange/appsuite-frontend",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "489e7d0bf2bb0dc4c984860c4ce6f4d772086875"
},
{
"introduced": "489e7d0bf2bb0dc4c984860c4ce6f4d772086875"
},
{
"last_affected": "efe84c3e5c1d116b8de98b33deada8c4d1b14a28"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "7.10.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-NA"
},
{
"last_affected": "7.10.6-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev10"
},
{
"last_affected": "7.10.6-rev10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev11"
},
{
"last_affected": "7.10.6-rev11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev12"
},
{
"last_affected": "7.10.6-rev12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev13"
},
{
"last_affected": "7.10.6-rev13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev14"
},
{
"last_affected": "7.10.6-rev14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev15"
},
{
"last_affected": "7.10.6-rev15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev16"
},
{
"last_affected": "7.10.6-rev16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev17"
},
{
"last_affected": "7.10.6-rev17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev18"
},
{
"last_affected": "7.10.6-rev18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev19"
},
{
"last_affected": "7.10.6-rev19"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev20"
},
{
"last_affected": "7.10.6-rev20"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev21"
},
{
"last_affected": "7.10.6-rev21"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev22"
},
{
"last_affected": "7.10.6-rev22"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev23"
},
{
"last_affected": "7.10.6-rev23"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev24:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev24"
},
{
"last_affected": "7.10.6-rev24"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev25:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev25"
},
{
"last_affected": "7.10.6-rev25"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev26:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev26"
},
{
"last_affected": "7.10.6-rev26"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev27:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev27"
},
{
"last_affected": "7.10.6-rev27"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev28:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev28"
},
{
"last_affected": "7.10.6-rev28"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev29:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev29"
},
{
"last_affected": "7.10.6-rev29"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev30:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev30"
},
{
"last_affected": "7.10.6-rev30"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev31:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev31"
},
{
"last_affected": "7.10.6-rev31"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev32:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev32"
},
{
"last_affected": "7.10.6-rev32"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev33:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev33"
},
{
"last_affected": "7.10.6-rev33"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev34:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev34"
},
{
"last_affected": "7.10.6-rev34"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev35:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev35"
},
{
"last_affected": "7.10.6-rev35"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev36:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev36"
},
{
"last_affected": "7.10.6-rev36"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"7.10.6-NA",
"7.10.6-rev10",
"7.10.6-rev11",
"7.10.6-rev12",
"7.10.6-rev13",
"7.10.6-rev14",
"7.10.6-rev15",
"7.10.6-rev16",
"7.10.6-rev17",
"7.10.6-rev18",
"7.10.6-rev19",
"7.10.6-rev20",
"7.10.6-rev21",
"7.10.6-rev22",
"7.10.6-rev23",
"7.10.6-rev24",
"7.10.6-rev25",
"7.10.6-rev26",
"7.10.6-rev27",
"7.10.6-rev28",
"7.10.6-rev29",
"7.10.6-rev30",
"7.10.6-rev31",
"7.10.6-rev32",
"7.10.6-rev33",
"7.10.6-rev34",
"7.10.6-rev35",
"7.10.6-rev36",
"7.10.6-36",
"7.10.6-21",
"as-next",
"7.10.5-2",
"7.10.5-1",
"7.10.5-0",
"7.10.4-1",
"7.10.4-0",
"7.10.3-0",
"7.10.0-2",
"7.10.0-0",
"7.8.3-10",
"7.8.3-9",
"7.8.2-16",
"7.8.2-14",
"7.8.2-9",
"7.8.2-7",
"7.8.2-6",
"7.8.2-5",
"7.8.1-14",
"7.8.1-11",
"7.8.1-10",
"7.8.0-19",
"7.8.0-12",
"7.8.0-11",
"7.8.0-10",
"7.8.0-8",
"7.8.0-7",
"7.6.2-24",
"7.6.2-23",
"7.6.2-22",
"7.6.2-19",
"7.6.2-18",
"7.6.2-16",
"7.6.2-13",
"7.4.1-6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-24598.json"
}
}
],
"modified": "2026-10-28T02:30:30.201249977Z",
"provider": "osv",
"references": [
"https://open-xchange.com",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24598.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-24598"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24598.json"
}
},
"related_cves": [
{
"value": "CVE-2023-24598",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 497400,
"published_at": "2023-05-29T00:00:00+00:00"
}