CVE-2023-41710
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedUser-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceA stored Cross-Site Scripting (XSS) vulnerability exists in the upsell-related shop URL functionality. Attackers can store malicious JavaScript code as user-defined content, which executes without proper sanitization when rendered in the DOM, allowing script execution in the context of the trusted domain.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 7.10.6= 7.10.6CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Open Xchange Ox App Suite installationLocate the Ox App Suite installation directory and check for version file, typically found in /opt/open-xchange or similar paths depending on installation methodAffected if The installed version is lower than 7.10.6 or equals exactly 7.10.6
-
Determine installed version numberRead the version file or use the package manager to query the installed ox-app-suite package versionAffected if Version matches < 7.10.6 or = 7.10.6 as listed in affected versions
-
Locate upsell shop URL configurationSearch configuration files for shop URL settings, typically in ox-config or ui-config files, look for terms like 'shop', 'upsell', or 'url' in configuration directoriesAffected if User-defined shop URL content is stored in configuration and can be set by end users
-
Verify if upsell feature is enabledCheck configuration files or database settings for the upsell-related shop URL feature flag or parameter that enables this functionalityAffected if The upsell shop URL feature is enabled and accepts user-supplied input
-
Inspect DOM rendering of shop URLAccess the application as a user, navigate to areas where shop URLs are rendered, and inspect the page source to see if user-defined URLs are being output without sanitizationAffected if User-supplied content in shop URL fields appears unencoded in HTML source
You are affected if Open Xchange Ox App Suite version is < 7.10.6 or equals 7.10.6 AND the upsell-related shop URL feature with user-defined content is enabled in your environment.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped7.10.6
Apply proper input validation and output encoding/sanitization when rendering user-supplied content in the DOM to prevent XSS execution.
7.10.7 or later (any version after 7.10.6 that includes the sanitization patch)
- 1. Identify current Ox App Suite version by checking the administration interface or using the command line tool oxversion
- 2. Plan an upgrade to version 7.10.7 or later, which contains the sanitization fix for the upsell shop URL XSS vulnerability
- 3. Before upgrading, backup all configuration files, databases, and user data
- 4. Schedule the upgrade during a maintenance window to minimize user impact
- 5. Execute the upgrade following the standard Ox App Suite upgrade procedure documented at documentation.open-xchange.com
- 6. After upgrade, verify the upsell shop functionality works correctly and that the sanitization is properly applied
- 7. Clear browser caches and test with a non-malicious script to confirm the fix does not break legitimate functionality
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,408.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2023-41710 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2023-41710 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data