Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could be read even though they are not explicitly shared. We improved permission handling when requesting snippets that are not explicitly shared with other users. No publicly available exploits are known.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html - Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2023/Jun/8 - Mailing List, Third Party Advisory | |
| References | () https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json - | |
| References | () https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf - Release Notes |
12 Jan 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
07 Jul 2023, 18:27
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-639 | |
| References | (MISC) http://seclists.org/fulldisclosure/2023/Jun/8 - Mailing List, Third Party Advisory | |
| References | (MISC) http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html - Third Party Advisory, VDB Entry | |
| References | (MISC) https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf - Release Notes | |
| References | (MISC) https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0002.json - Third Party Advisory | |
| CPE | cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:*:*:*:*:*:*:*:* cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:*:*:*:*:*:*:* cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:revision_39:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| First Time |
Open-xchange
Open-xchange open-xchange Appsuite Backend |
22 Jun 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
22 Jun 2023, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Jun 2023, 13:03
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-20 08:15
Updated : 2024-11-21 07:51
NVD link : CVE-2023-26428
Mitre link : CVE-2023-26428
CVE.ORG link : CVE-2023-26428
JSON object : View
Products Affected
open-xchange
- open-xchange_appsuite_backend
CWE
CWE-639
Authorization Bypass Through User-Controlled Key