CVE-2024-25582

Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social engineering to make a user follow a prepared link to a malicious account. Please deploy the provided updates and patch releases. The savepoint module path has been restricted to modules that provide the feature, excluding any arbitrary or non-existing modules. No publicly available exploits are known.

• CWE-79

• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0003.json
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6277_7.10.6_2024-05-06.pdf
• http://seclists.org/fulldisclosure/2024/Aug/37

Published

Aug 19, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-25576improper access control in firmware for some Intel(R) FPGA p…7.9
• CVE-2024-25578 MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and …7.8
• CVE-2024-25579OS command injection vulnerability in ELECOM wireless LAN ro…6.8
• CVE-2024-2558A vulnerability was found in Tenda AC18 15.03.05.05. It has …8.8
• CVE-2024-25580An issue was discovered in gui/util/qktxhandler.cpp in Qt be…6.2
• CVE-2024-25581When incoming DNS over HTTPS support is enabled using the ng…7.5
• CVE-2024-25583A crafted response from an upstream server the recursor has …7.5
• CVE-2024-25584Dovecot accepts dot LF DOT LF symbol as end of DATA command.…5.3
• CVE-2024-2559A vulnerability classified as problematic has been found in …6.5
• CVE-2024-25590An attacker can publish a zone containing specific Resource …7.5
• CVE-2024-25591Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2024-25592Improper Neutralization of Input During Web Page Generation …4.8