Lucene search

OXCVE-2023-26427

HistoryJun 20, 2023 - 8:15 a.m.

CVE-2023-26427

2023-06-2008:15:09

CWE-732

CWE-922

web.nvd.nist.gov

cve-2023-26427

permissions

properties file

security update

package installation

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.2

Confidence

High

EPSS

Percentile

15.5%

JSON

Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known.

Affected configurations

Nvd

Node

open-xchangeopen-xchange_appsuite_backendRange<7.10.6

open-xchangeopen-xchange_appsuite_backendMatch7.10.6

open-xchangeopen-xchange_appsuite_backendMatch7.10.6revision_39

VendorProductVersionCPE
open-xchangeopen-xchange_appsuite_backend*cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:*:*:*:*:*:*:*:*
open-xchangeopen-xchange_appsuite_backend7.10.6cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:*:*:*:*:*:*:*
open-xchangeopen-xchange_appsuite_backend7.10.6cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:revision_39:*:*:*:*:*:*

Vendor	Product	Version	CPE
open-xchange	open-xchange_appsuite_backend	*	cpe:2.3:a:open-xchange:open-xchange_appsuite_backend::::::::
open-xchange	open-xchange_appsuite_backend	7.10.6	cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:::::::*
open-xchange	open-xchange_appsuite_backend	7.10.6	cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:revision_39::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "backend"
    ],
    "product": "OX App Suite",
    "vendor": "OX Software GmbH",
    "versions": [
      {
        "lessThanOrEqual": "7.10.6-rev39",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html

seclists.org/fulldisclosure/2023/Jun/8

documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json

software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.2

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for CVE-2023-26427