CVE-2025-30191

Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedure. No publicly available exploits are known

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2025/oxas-adv-2025-0002.json

Configurations

No configuration.

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El contenido malicioso de correo electrónico puede utilizarse para realizar un ataque de redressing. Los usuarios pueden ser engañados para realizar acciones no intencionadas o proporcionar información sensible a un tercero, lo que posibilitaría nuevas amenazas. Los valores de atributo que contienen fragmentos HTML ahora son denegados por el procedimiento de sanitización. No se conocen exploits disponibles públicamente.

Information

Published : 2025-10-31 09:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-30191

Mitre link : CVE-2025-30191

CVE.ORG link : CVE-2025-30191

JSON object : View

Products Affected

No product.

CWE

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

{"id": "CVE-2025-30191", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-30191", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-31T18:16:04.949644Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@open-xchange.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@open-xchange.com", "affectedData": [{"vendor": "Open-Xchange GmbH", "modules": ["backend"], "product": "OX App Suite", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.6.3-rev77"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.35.111"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.38.82"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.39.79"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.40.57"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-31T09:15:47.860", "references": [{"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2025/oxas-adv-2025-0002.json", "source": "security@open-xchange.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@open-xchange.com", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedure. No publicly available exploits are known"}, {"lang": "es", "value": "El contenido malicioso de correo electr\u00f3nico puede utilizarse para realizar un ataque de redressing. Los usuarios pueden ser enga\u00f1ados para realizar acciones no intencionadas o proporcionar informaci\u00f3n sensible a un tercero, lo que posibilitar\u00eda nuevas amenazas. Los valores de atributo que contienen fragmentos HTML ahora son denegados por el procedimiento de sanitizaci\u00f3n. No se conocen exploits disponibles p\u00fablicamente."}], "lastModified": "2026-10-07T21:10:00.200", "sourceIdentifier": "security@open-xchange.com"}