Authentication flaw

2023-11-0214:15:00

PRIOn knowledge base

www.prio-n.com

rmi service

authentication requirement

calendar items

local network access

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.

CPENameOperatorVersion
open-xchange_appsuiteeq7.10.6
open-xchange_appsuiteeq7.10.6 patchrelease6069
open-xchange_appsuiteeq7.10.6 patchrelease6073
open-xchange_appsuiteeq7.10.6 patchrelease6080
open-xchange_appsuiteeq7.10.6 patchrelease6085
open-xchange_appsuiteeq7.10.6 patchrelease6093
open-xchange_appsuiteeq7.10.6 patchrelease6102
open-xchange_appsuiteeq7.10.6 patchrelease6112
open-xchange_appsuiteeq7.10.6 patchrelease6121
open-xchange_appsuiteeq7.10.6 patchrelease6133

Name	Operator	Version
open-xchange_appsuite	eq	7.10.6
open-xchange_appsuite	eq	7.10.6 patchrelease6069
open-xchange_appsuite	eq	7.10.6 patchrelease6073
open-xchange_appsuite	eq	7.10.6 patchrelease6080
open-xchange_appsuite	eq	7.10.6 patchrelease6085
open-xchange_appsuite	eq	7.10.6 patchrelease6093
open-xchange_appsuite	eq	7.10.6 patchrelease6102
open-xchange_appsuite	eq	7.10.6 patchrelease6112
open-xchange_appsuite	eq	7.10.6 patchrelease6121
open-xchange_appsuite	eq	7.10.6 patchrelease6133