CVE-2023-41703

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-417046.1Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script c CVE-2023-417056.5Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load.CVE-2023-417066.5Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Av CVE-2023-417076.5Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load CVE-2023-417085.4References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypa CVE-2023-41715.3A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability af CVE-2023-417105.4User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attacke CVE-2023-417116.5SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crash CVE-2023-417126.5SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash.CVE-2023-417137.5SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.CVE-2023-417158.8SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileg CVE-2023-417175.5Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restricti