CVE-2023-26441: fallo de gravedad media en OX App Suite
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.7epss 0.4%
Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access to the database and a local or restricted network would be able to read arbitrary local file system resources that are accessible by the services system user account. We have improved path validation and make sure that any access is contained to the defined root directory. No publicly available exploits are known.
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L
Productos afectados
OX Software GmbH · OX App SuiteCVEs relacionadas — OX App Suite
En el mismo producto, de las más peligrosas a las menos.
Referencias
http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.htmlhttps://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.jsonhttp://seclists.org/fulldisclosure/2023/Aug/8https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf