CVE-2023-25292

MediumCVSS 6.1

Published: 27/04/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.58%

44th percentile - higher than 44% of all known CVEs

Summary

A reflected Cross Site Scripting (XSS) vulnerability was found in Intermesh BV Group-Office version 6.6.145. Attackers can exploit the GO_LANGUAGE cookie to escalate privileges and obtain sensitive information.

Risk Assessment

The risk involves potential account takeover and theft of sensitive organizational data by a remote unauthenticated attacker.

Recommendation

Immediately update Group-Office to the latest version and implement XSS protection mechanisms such as Content Security Policy.

Original NVD description (English source)

Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie.