Code injection

2023-06-2008:15:00

PRIOn knowledge base

www.prio-n.com

code injection

imap

security

4.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.0%

JSON

When adding an external mail account, processing of IMAP “capabilities” responses are not limited to plausible sizes. Attacker with access to a rogue IMAP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted IMAP server response to reasonable length/size. No publicly available exploits are known.

CPENameOperatorVersion
open-xchange_appsuite_backendlt7.10.6
open-xchange_appsuite_backendeq7.10.6
open-xchange_appsuite_backendeq7.10.6 revision-39
open-xchange_appsuite_backendge8.0.0
open-xchange_appsuite_backendlt8.11.0

Name	Operator	Version
open-xchange_appsuite_backend	lt	7.10.6
open-xchange_appsuite_backend	eq	7.10.6
open-xchange_appsuite_backend	eq	7.10.6 revision-39
open-xchange_appsuite_backend	ge	8.0.0
open-xchange_appsuite_backend	lt	8.11.0