CVE-2023-48104: 
NixOS vulnerability analysis and mitigation

Alinto SOGo before version 5.9.1 was found to be vulnerable to HTML Injection. The vulnerability was discovered and disclosed in November 2023, affecting the SOGo web client, which is a collaborative software server with a focus on calendaring and webmail operations (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed, with low impacts on both confidentiality and integrity, and no impact on availability (NVD).

The vulnerability allows attackers to inject HTML code into the application, which could lead to various security issues including phishing attacks through malicious form injection and potential data theft. The impact is particularly concerning as it affects the integrity of the web interface and could be used to manipulate content displayed to users (Debian Tracker).

The vulnerability has been fixed in SOGo version 5.9.1. Users are advised to upgrade to this version or later to mitigate the risk. The fix involves preventing HTML injection of tag forms as implemented in the patch (SOGo Commit).