Unrated
Security advisory
OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-24601
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 8 Nov 2026, 02:50 UTC · Revision 1
Source evidence
OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.
osv:CVE-2023-24601
Complete source record
{
"id": "3297c0efaac665bf21e0016357c3a69cf2fdfb189e019827cec65637c231bf95",
"url": "https://osv.dev/vulnerability/CVE-2023-24601",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2023-24601",
"summary": "OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.",
"evidence": "osv:CVE-2023-24601",
"products": [],
"severity": "unknown",
"structured": {
"id": "CVE-2023-24601",
"aliases": [
"CVE-2023-24601"
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/open-xchange/appsuite-frontend",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "489e7d0bf2bb0dc4c984860c4ce6f4d772086875"
},
{
"introduced": "489e7d0bf2bb0dc4c984860c4ce6f4d772086875"
},
{
"last_affected": "021e33ad79d579d1aafd21fde5da27ab133bdfd1"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "7.10.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-NA"
},
{
"last_affected": "7.10.6-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev10"
},
{
"last_affected": "7.10.6-rev10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev11"
},
{
"last_affected": "7.10.6-rev11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev12"
},
{
"last_affected": "7.10.6-rev12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev13"
},
{
"last_affected": "7.10.6-rev13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev14"
},
{
"last_affected": "7.10.6-rev14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev15"
},
{
"last_affected": "7.10.6-rev15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev16"
},
{
"last_affected": "7.10.6-rev16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev17"
},
{
"last_affected": "7.10.6-rev17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev18"
},
{
"last_affected": "7.10.6-rev18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev19"
},
{
"last_affected": "7.10.6-rev19"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev20"
},
{
"last_affected": "7.10.6-rev20"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev21"
},
{
"last_affected": "7.10.6-rev21"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev22"
},
{
"last_affected": "7.10.6-rev22"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev23"
},
{
"last_affected": "7.10.6-rev23"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"7.10.6-NA",
"7.10.6-rev10",
"7.10.6-rev11",
"7.10.6-rev12",
"7.10.6-rev13",
"7.10.6-rev14",
"7.10.6-rev15",
"7.10.6-rev16",
"7.10.6-rev17",
"7.10.6-rev18",
"7.10.6-rev19",
"7.10.6-rev20",
"7.10.6-rev21",
"7.10.6-rev22",
"7.10.6-rev23",
"7.10.6-23",
"7.10.6-21",
"as-next",
"7.10.5-2",
"7.10.5-1",
"7.10.5-0",
"7.10.4-1",
"7.10.4-0",
"7.10.3-0",
"7.10.0-2",
"7.10.0-0",
"7.8.3-10",
"7.8.3-9",
"7.8.2-16",
"7.8.2-14",
"7.8.2-9",
"7.8.2-7",
"7.8.2-6",
"7.8.2-5",
"7.8.1-14",
"7.8.1-11",
"7.8.1-10",
"7.8.0-19",
"7.8.0-12",
"7.8.0-11",
"7.8.0-10",
"7.8.0-8",
"7.8.0-7",
"7.6.2-24",
"7.6.2-23",
"7.6.2-22",
"7.6.2-19",
"7.6.2-18",
"7.6.2-16",
"7.6.2-13",
"7.4.1-6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-24601.json"
}
}
],
"modified": "2026-10-28T02:30:53.120441092Z",
"provider": "osv",
"references": [
"https://open-xchange.com",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24601.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-24601"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24601.json"
}
},
"related_cves": [
{
"value": "CVE-2023-24601",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 521946,
"published_at": "2023-05-29T00:00:00+00:00"
}