OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used.
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Open-xchange_appsuite | Open-xchange | 7.10.3 (including) | 7.10.3 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-patch_release5547 (including) | 7.10.3-patch_release5547 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-patch_release5572 (including) | 7.10.3-patch_release5572 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-patch_release5623 (including) | 7.10.3-patch_release5623 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-patch_release5653 (including) | 7.10.3-patch_release5653 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-patch_release5677 (including) | 7.10.3-patch_release5677 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-patch_release5720 (including) | 7.10.3-patch_release5720 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev1 (including) | 7.10.3-rev1 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev10 (including) | 7.10.3-rev10 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev11 (including) | 7.10.3-rev11 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev12 (including) | 7.10.3-rev12 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev13 (including) | 7.10.3-rev13 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev14 (including) | 7.10.3-rev14 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev15 (including) | 7.10.3-rev15 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev16 (including) | 7.10.3-rev16 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev17 (including) | 7.10.3-rev17 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev18 (including) | 7.10.3-rev18 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev19 (including) | 7.10.3-rev19 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev2 (including) | 7.10.3-rev2 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev20 (including) | 7.10.3-rev20 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev21 (including) | 7.10.3-rev21 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev22 (including) | 7.10.3-rev22 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev23 (including) | 7.10.3-rev23 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev24 (including) | 7.10.3-rev24 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev25 (including) | 7.10.3-rev25 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev26 (including) | 7.10.3-rev26 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev27 (including) | 7.10.3-rev27 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev28 (including) | 7.10.3-rev28 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev29 (including) | 7.10.3-rev29 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev3 (including) | 7.10.3-rev3 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev30 (including) | 7.10.3-rev30 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev31 (including) | 7.10.3-rev31 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev4 (including) | 7.10.3-rev4 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev5 (including) | 7.10.3-rev5 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev6 (including) | 7.10.3-rev6 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev7 (including) | 7.10.3-rev7 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev8 (including) | 7.10.3-rev8 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.3-rev9 (including) | 7.10.3-rev9 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4 (including) | 7.10.4 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev1 (including) | 7.10.4-rev1 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev10 (including) | 7.10.4-rev10 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev11 (including) | 7.10.4-rev11 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev12 (including) | 7.10.4-rev12 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev13 (including) | 7.10.4-rev13 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev14 (including) | 7.10.4-rev14 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev15 (including) | 7.10.4-rev15 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev16 (including) | 7.10.4-rev16 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev17 (including) | 7.10.4-rev17 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev2 (including) | 7.10.4-rev2 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev3 (including) | 7.10.4-rev3 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev4 (including) | 7.10.4-rev4 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev5 (including) | 7.10.4-rev5 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev6 (including) | 7.10.4-rev6 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev7 (including) | 7.10.4-rev7 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev8 (including) | 7.10.4-rev8 (including) |
| Open-xchange_appsuite | Open-xchange | 7.10.4-rev9 (including) | 7.10.4-rev9 (including) |