Lucene search

[email protected]CVE-2023-26429

HistoryJun 20, 2023 - 8:15 a.m.

CVE-2023-26429

2023-06-2008:15:09

CWE-77

[email protected]

web.nvd.nist.gov

cve-2023-26429

control characters

user feedback

data structure

exploit

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.3 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.6%

JSON

Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentially break the exported data structure. We now drop all control characters that are not whitespace character during the export. No publicly available exploits are known.

Affected configurations

NVD

Node

open-xchangeopen-xchange_appsuite_backendRange<7.10.6

open-xchangeopen-xchange_appsuite_backendRange8.0.0–8.11.0

open-xchangeopen-xchange_appsuite_backendMatch7.10.6

open-xchangeopen-xchange_appsuite_backendMatch7.10.6revision_39

CPENameOperatorVersion
open-xchange:open-xchange_appsuite_backendopen-xchange open-xchange appsuite backendlt7.10.6
open-xchange:open-xchange_appsuite_backendopen-xchange open-xchange appsuite backendlt8.11.0

CPE	Name	Operator	Version
open-xchange:open-xchange_appsuite_backend	open-xchange open-xchange appsuite backend	lt	7.10.6
open-xchange:open-xchange_appsuite_backend	open-xchange open-xchange appsuite backend	lt	8.11.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "backend"
    ],
    "product": "OX App Suite",
    "vendor": "OX Software GmbH",
    "versions": [
      {
        "lessThanOrEqual": "7.10.6-rev39",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.10",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html

seclists.org/fulldisclosure/2023/Jun/8

documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json

software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.3 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.6%

JSON

Related for CVE-2023-26429

prion1 cvelist1 nvd1