Medium
Security advisory
OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-43698
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 21:17 UTC · Revision 1
Source evidence
OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.
osv:CVE-2022-43698
Complete source record
{
"id": "d68e2d847f963c1950cbfb908c56837bfdb0ecb80b28756bc0594b0526fd91fb",
"url": "https://osv.dev/vulnerability/CVE-2022-43698",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2022-43698",
"summary": "OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.",
"evidence": "osv:CVE-2022-43698",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2022-43698",
"aliases": [
"CVE-2022-43698"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/open-xchange/appsuite-frontend",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "489e7d0bf2bb0dc4c984860c4ce6f4d772086875"
},
{
"introduced": "489e7d0bf2bb0dc4c984860c4ce6f4d772086875"
},
{
"last_affected": "44346efd29f6f2a5bc2880a95ffbe885c86898f2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "7.10.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-NA"
},
{
"last_affected": "7.10.6-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev10"
},
{
"last_affected": "7.10.6-rev10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev11"
},
{
"last_affected": "7.10.6-rev11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev12"
},
{
"last_affected": "7.10.6-rev12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev13"
},
{
"last_affected": "7.10.6-rev13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev14"
},
{
"last_affected": "7.10.6-rev14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev15"
},
{
"last_affected": "7.10.6-rev15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev16"
},
{
"last_affected": "7.10.6-rev16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev17"
},
{
"last_affected": "7.10.6-rev17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev18"
},
{
"last_affected": "7.10.6-rev18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev19"
},
{
"last_affected": "7.10.6-rev19"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev20"
},
{
"last_affected": "7.10.6-rev20"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev21"
},
{
"last_affected": "7.10.6-rev21"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev22"
},
{
"last_affected": "7.10.6-rev22"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev23"
},
{
"last_affected": "7.10.6-rev23"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev24:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev24"
},
{
"last_affected": "7.10.6-rev24"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev25:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev25"
},
{
"last_affected": "7.10.6-rev25"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev26:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev26"
},
{
"last_affected": "7.10.6-rev26"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev27:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev27"
},
{
"last_affected": "7.10.6-rev27"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev28:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev28"
},
{
"last_affected": "7.10.6-rev28"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev29:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev29"
},
{
"last_affected": "7.10.6-rev29"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"7.10.6-NA",
"7.10.6-rev10",
"7.10.6-rev11",
"7.10.6-rev12",
"7.10.6-rev13",
"7.10.6-rev14",
"7.10.6-rev15",
"7.10.6-rev16",
"7.10.6-rev17",
"7.10.6-rev18",
"7.10.6-rev19",
"7.10.6-rev20",
"7.10.6-rev21",
"7.10.6-rev22",
"7.10.6-rev23",
"7.10.6-rev24",
"7.10.6-rev25",
"7.10.6-rev26",
"7.10.6-rev27",
"7.10.6-rev28",
"7.10.6-rev29",
"7.10.6-29",
"7.10.6-21",
"as-next",
"7.10.5-2",
"7.10.5-1",
"7.10.5-0",
"7.10.4-1",
"7.10.4-0",
"7.10.3-0",
"7.10.0-2",
"7.10.0-0",
"7.8.3-10",
"7.8.3-9",
"7.8.2-16",
"7.8.2-14",
"7.8.2-9",
"7.8.2-7",
"7.8.2-6",
"7.8.2-5",
"7.8.1-14",
"7.8.1-11",
"7.8.1-10",
"7.8.0-19",
"7.8.0-12",
"7.8.0-11",
"7.8.0-10",
"7.8.0-8",
"7.8.0-7",
"7.6.2-24",
"7.6.2-23",
"7.6.2-22",
"7.6.2-19",
"7.6.2-18",
"7.6.2-16",
"7.6.2-13",
"7.4.1-6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-43698.json"
}
}
],
"modified": "2026-10-28T02:30:23.531387469Z",
"provider": "osv",
"references": [
"https://open-xchange.com",
"https://seclists.org/fulldisclosure/2023/Feb/3",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43698.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-43698"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43698.json"
}
},
"related_cves": [
{
"value": "CVE-2022-43698",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 490165,
"published_at": "2023-04-15T00:00:00+00:00"
}