CVE-2024-25582
Reported by ox · Published August 19, 2024
Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social engineering to make a user follow a prepared link to a malicious account. Please deploy the provided updates and patch releases. The savepoint module path has been restricted to modules that provide the feature, excluding any arbitrary or non-existing modules. No publicly available exploits are known.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| OX App Suite | Open-Xchange GmbH | 7.10.6-rev42 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX App Suite | 0 |
| Open-Xchange GmbH | OX App Suite | 0 |
Timeline
- Apr 23, 2024 CVE Published
- Aug 19, 2024 PoC Published
- Aug 20, 2024 EPSS Score (30 in total, the first dated here)
- Oct 4, 2024 Coalition ESS Score (7 in total, the first dated here)
- Mar 31, 2026 Security Advisory
- Apr 15, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-25582
vulnetix vdb fixes CVE-2024-25582Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-25582/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- release-notes
- vendor-advisory
- http://seclists.org/fulldisclosure/2024/Aug/37 url