Vulnerability Details CVE-2023-26429
Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentially break the exported data structure. We now drop all control characters that are not whitespace character during the export. No publicly available exploits are known.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 34.5%
CVSS Severity
CVSS v3 Score 3.5
References
- http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html
- http://seclists.org/fulldisclosure/2023/Jun/8
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf
- http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html
- http://seclists.org/fulldisclosure/2023/Jun/8
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf
Products affected by CVE-2023-26429
-
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6
-
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.6.2
-
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.6.3
-
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.8.0
-
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.8.2
-
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.8.3
-
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:8.0.0
-
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:8.10.0
-
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:8.9.0