CVE-2021-33491

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.htmlExploit, Third Party Advisory, VDB Entry
https://open-xchange.comProduct, Vendor Advisory
https://seclists.org/fulldisclosure/2021/Nov/42Exploit, Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.htmlExploit, Third Party Advisory, VDB Entry
https://open-xchange.comProduct, Vendor Advisory
https://seclists.org/fulldisclosure/2021/Nov/42Exploit, Mailing List, Third Party Advisory

Timeline

Published: Nov 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-334926.1OX App Suite 7.10.5 allows XSS via an OX Chat room name.CVE-2021-334936.0The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.CVE-2021-334946.1OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.CVE-2021-334956.1OX App Suite 7.10.5 allows XSS via an OX Chat system message.CVE-2021-334966.1Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.CVE-2021-334979.1Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.CVE-2021-334987.5Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2).CVE-2021-334997.5Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2).CVE-2021-33506.1deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.CVE-2021-335007.5PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its CVE-2021-335019.6Overwolf Client 0.169.0.22 allows XSS, with resultant Remote Code Execution, via an overwolfstore:// URL.CVE-2021-335027.5The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service