Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could be read even though they are not explicitly shared. We improved permission handling when requesting snippets that are not explicitly shared with other users. No publicly available exploits are known.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html | Third Party Advisory VDB Entry |
http://seclists.org/fulldisclosure/2023/Jun/8 | Mailing List Third Party Advisory |
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json | |
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf | Release Notes |
Configurations
Configuration 1 (hide)
|
History
12 Jan 2024, 08:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
07 Jul 2023, 18:27
Type | Values Removed | Values Added |
---|---|---|
First Time |
Open-xchange open-xchange Appsuite Backend
Open-xchange |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
References | (MISC) https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf - Release Notes | |
References | (MISC) http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html - Third Party Advisory, VDB Entry | |
References | (MISC) https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0002.json - Third Party Advisory | |
References | (MISC) http://seclists.org/fulldisclosure/2023/Jun/8 - Mailing List, Third Party Advisory | |
CWE | CWE-639 | |
CPE | cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:*:*:*:*:*:*:*:* cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:*:*:*:*:*:*:* cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:revision_39:*:*:*:*:*:* |
22 Jun 2023, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
22 Jun 2023, 00:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
20 Jun 2023, 08:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-06-20 08:15
Updated : 2024-01-12 08:15
NVD link : CVE-2023-26428
Mitre link : CVE-2023-26428
CVE.ORG link : CVE-2023-26428
JSON object : View
Products Affected
open-xchange
- open-xchange_appsuite_backend
CWE
CWE-639
Authorization Bypass Through User-Controlled Key