CVE-2023-41703

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.

• CWE-79
• CWE-79

• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.jsonVendor Advisory
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdfVendor Advisory
• http://seclists.org/fulldisclosure/2024/Feb/10
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.jsonVendor Advisory
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdfVendor Advisory

Published

Feb 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41694Cross-Site Request Forgery (CSRF) vulnerability in Realbig T…8.8
• CVE-2023-41695Missing Authorization vulnerability in Adnan Analytify wp-an…8.8
• CVE-2023-41696Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-41697Cross-Site Request Forgery (CSRF) vulnerability in Nikunj So…8.8
• CVE-2023-41699URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
• CVE-2023-4170A vulnerability was found in DedeBIZ 6.2.10. It has been rat…4.8
• CVE-2023-41704Processing of CID references at E-Mail can be abused to inje…6.1
• CVE-2023-41705Processing of user-defined DAV user-agent strings is not lim…6.5
• CVE-2023-41706Processing time of drive search expressions now gets monitor…6.5
• CVE-2023-41707Processing of user-defined mail search expressions is not li…6.5
• CVE-2023-41708References to the "app loader" functionality could contain r…5.4
• CVE-2023-4171A vulnerability classified as problematic was found in Cheng…5.3