CVE-2023-26428

Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could be read even though they are not explicitly shared. We improved permission handling when requesting snippets that are not explicitly shared with other users. No publicly available exploits are known.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html	Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2023/Jun/8	Mailing List Third Party Advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf	Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:open-xchange:open-xchange_appsuite_backend::::::::
	cpe:2.3:a:open-xchange:open-xchange_appsuite_backend::::::::
	cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:::::::*
	cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:revision_39::::::

History

No history.

Information

Published : 2023-06-20 08:15

Updated : 2024-01-12 08:15

NVD link : CVE-2023-26428

Mitre link : CVE-2023-26428

CVE.ORG link : CVE-2023-26428

JSON object : View

Products Affected

open-xchange

open-xchange_appsuite_backend

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2023-26428", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security@open-xchange.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-06-20T08:15:09.163", "references": [{"url": "http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@open-xchange.com"}, {"url": "http://seclists.org/fulldisclosure/2023/Jun/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@open-xchange.com"}, {"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json", "source": "security@open-xchange.com"}, {"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf", "tags": ["Release Notes"], "source": "security@open-xchange.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-639"}]}, {"type": "Secondary", "source": "security@open-xchange.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could be read even though they are not explicitly shared. We improved permission handling when requesting snippets that are not explicitly shared with other users. No publicly available exploits are known.\n\n"}], "lastModified": "2024-01-12T08:15:39.950", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74EDAF14-4BF1-4E62-AA44-86090B6BEEFD", "versionEndExcluding": "7.10.6"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73183E5C-54B0-4426-BD3B-34C19BBDECEE", "versionEndExcluding": "8.11.0", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D41FD049-C028-4C6D-A9D7-9DD1820B2C5F"}, {"criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:revision_39:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B382924-49BE-43BF-B012-7F8F8A90CA6C"}], "operator": "OR"}]}], "sourceIdentifier": "security@open-xchange.com"}