# OXAS-ADV-2024-0005

## Metadata

* Document type: OX App Suite Security Advisory
* Publisher: Open-Xchange GmbH
* Classification: TLP:GREEN
* Publication Date: 2024-07-08
* Current version: 2
* Version status: Final
* Aggregate severity: High

## References

* [CSAF document](https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0005.json)
* [Release Notes (.pdf)](https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6292_7.10.6_2024-07-08.pdf)
* [Advisory (.md)](https://documentation.open-xchange.com/appsuite/security/advisories/md/2024/oxas-adv-2024-0005.md)
* [Advisory (.html)](https://documentation.open-xchange.com/appsuite/security/advisories/html/2024/oxas-adv-2024-0005.html)
* [Advisory (.txt)](https://documentation.open-xchange.com/appsuite/security/advisories/txt/2024/oxas-adv-2024-0005.txt)

## Vulnerabilities

### CVE-2024-22243: CVE-2024-22243 Spring Framework URL Parsing with Host Validation

* CVE reference: [CVE-2024-22243](https://www.cve.org/CVERecord?id=CVE-2024-22243)
* Internal reference: MWB-2534
* CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
* Discovery date: 2024-03-05
#### Description

A "open redirect" vulnerability has been reported for a version of the Spring Framework which is shipped with OX App Suite.

#### Product status

##### Last affected

| Products | CVSS-Vector | CVSS Base Score |
|-|-|-|
| OX App Suite backend 7.10.6-rev66 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | 8.1 |
| OX App Suite backend 8.24.7 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | 8.1 |

#### Threats

##### Impact

Please see CVE-2024-22243 "Spring Framework URL Parsing with Host Validation" for more information by the vendor of the affected third-party component.

##### Exploit status

No publicly available exploits are known.

#### Remediation

##### Vendor fix (2024-07-08)

###### For products

* OX App Suite backend 7.10.6-rev67
* OX App Suite backend 8.24.8

Please deploy the provided updates and patch releases. The Spring framework shipped with OX App Suite and depending components has been updated as a precaution to avoid exposure to CVE-2024-22243.