CVE-2022-43699

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain (found in the host part of an e-mail address).

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://open-xchange.comProduct
https://seclists.org/fulldisclosure/2023/Feb/3Mailing List, Third Party Advisory
https://open-xchange.comProduct
https://seclists.org/fulldisclosure/2023/Feb/3Mailing List, Third Party Advisory

Timeline

Published: Apr 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-43707.2The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, l CVE-2022-437017.8When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation di CVE-2022-437027.8When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the CVE-2022-437037.8An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attac CVE-2022-437045.9The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate us CVE-2022-437059.1In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1 CVE-2022-437065.4Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pa CVE-2022-437076.1MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via CVE-2022-437086.1MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML CVE-2022-437094.9MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string vi CVE-2022-43717.2The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading CVE-2022-437108.8Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery (CSRF) bec