Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could be read even though they are not explicitly shared. We improved permission handling when requesting snippets that are not explicitly shared with other users. No publicly available exploits are known.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html | Third Party Advisory VDB Entry |
http://seclists.org/fulldisclosure/2023/Jun/8 | Mailing List Third Party Advisory |
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json | |
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf | Release Notes |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: OX
Published: 2023-06-20T07:51:36.529Z
Updated: 2024-01-12T07:14:53.031Z
Reserved: 2023-02-22T20:42:56.089Z
Link: CVE-2023-26428
JSON object: View
NVD Information
Status : Modified
Published: 2023-06-20T08:15:09.163
Modified: 2024-01-12T08:15:39.950
Link: CVE-2023-26428
JSON object: View
Redhat Information
No data.
CWE