CVE-2023-41705

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
Open-Xchange GmbHOX App Suite<= 7.10.6-rev55; <= 7.6.3-rev71; <= 8.20

References

Timeline

Published
Feb 12, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-417066.5Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. AvCVE-2023-417076.5Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing loadCVE-2023-417085.4References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypaCVE-2023-41715.3A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability afCVE-2023-417105.4User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. AttackeCVE-2023-417116.5SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crashCVE-2023-417126.5SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash.CVE-2023-417137.5SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.CVE-2023-417158.8SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privilegCVE-2023-417175.5Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictiCVE-2023-417187.8When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when haCVE-2023-417197.2A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a sp
CVE-2023-41705: Medium severity, CVSS 6.5 | Vulnix