full-disclosure - [FD] OXAS-ADV-2025-0002: OX App Suite Security Advisory

Open Source and information security mailing list archives

Message-ID: <977666456.1459.1761905438592@appsuite-pro-sync-core-mw-groupware-0.appsuite-pro-sync-core-mw-hazelcast-headless.appsuite.svc.cluster.local>
Date: Fri, 31 Oct 2025 11:10:38 +0100 (CET)
From: Martin Heiland via Fulldisclosure <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] OXAS-ADV-2025-0002: OX App Suite Security Advisory

Dear subscribers,

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs for OX App Suite, Dovecot and PowerDNS at YesWeHack.

This advisory has also been published at https://documentation.open-xchange.com/appsuite/security/advisories/html/2025/oxas-adv-2025-0002.html.

Yours sincerely,
  Martin Heiland, Open-Xchange GmbH

Classification: TLP:GREEN

Internal reference: appsuite/platform/core#336
Type: CWE-1021 (Improper Restriction of Rendered UI Layers or Frames)
Component: backend
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite backend 7.6.3-rev77, OX App Suite backend 8.35.111, OX App Suite backend 8.38.82, OX App Suite backend 8.39.79, OX App Suite backend 8.40.57
First fixed revision: OX App Suite backend 7.6.3-rev78, OX App Suite backend 8.35.112, OX App Suite backend 8.38.83, OX App Suite backend 8.39.80, OX App Suite backend 8.40.58
Discovery date: 2025-07-09
Solution date: 2025-07-10
CVE: CVE-2025-30191
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

Details:
HTML "form" elements can be used for spoofing and redressing. Malicious content from E-Mail can be used to perform a redressing attack.

Risk:
Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. No publicly available exploits are known

Solution:
Attribute values containing HTML fragments are now denied by the sanitization procedure.

---

Internal reference: appsuite/support#763
Type: CWE-400 (Uncontrolled Resource Consumption)
Component: ui middleware
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX App Suite ui middleware 2.1.7
First fixed revision: OX App Suite ui middleware 2.1.8
Discovery date: 2025-08-06
Solution date: 2025-08-12
CVE: CVE-2025-30188
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Details:
Version information can be used to pollute caches and cause denial of service. Malicious or unintentional API requests can be used to add significant amount of data to caches.

Risk:
Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component. No publicly available exploits are known

Solution:
Please deploy the provided updates and patch releases.

Download attachment "signature.asc" of type "application/pgp-signature" (822 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives