CVE-2023-25292
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A reflected Cross Site Scripting (XSS) vulnerability was found in Intermesh BV Group-Office version 6.6.145. Attackers can exploit the GO_LANGUAGE cookie to escalate privileges and obtain sensitive information.
Risk Assessment
The risk involves potential account takeover and theft of sensitive organizational data by a remote unauthenticated attacker.
Recommendation
Immediately update Group-Office to the latest version and implement XSS protection mechanisms such as Content Security Policy.
Other vulnerabilities in Group-Office
See all- CVE-2026-34838Critical
Group-Office prior to versions 6.8.156, 25.0.90, and 26.0.12 has a vulnerability in the AbstractSettingsCollection model leading to insecure deserialization, allowing arbitrary file write and remote code execution.
- CVE-2026-45551Medium
In Group-Office prior to versions 26.0.25, 25.0.100, and 6.8.165, authenticated users can persist arbitrary legacy settings for any user_id. A separate issue in the email module injects the email_font_size setting directly into JavaScript without escaping. A low-privileged user can overwrite an administrator's email_font_size setting with a JavaScript payload and trigger stored XSS in the administrator's browser.
Original NVD description (English source)
Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS