CVE-2023-41703: Open-Xchange Appsuite

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.

Affected products

• Open-Xchange Open-Xchange Appsuite: before 7.10.6 (fixed in 7.10.6); after 7.10.6, before 8.20 (fixed in 8.20); version 7.10.6 only

Published 2024-02-12. Last modified 2026-06-17.