GSD-2023-26455

Vulnerability from gsd - Updated: 2023-12-13 01:20
Details
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.
Aliases
Aliases
CVE-2023-26455
To clipboard 

{
  "GSD": {
    "alias": "CVE-2023-26455",
    "id": "GSD-2023-26455"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-26455"
      ],
      "details": "RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.\n\n",
      "id": "GSD-2023-26455",
      "modified": "2023-12-13T01:20:54.187348Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@open-xchange.com",
        "ID": "CVE-2023-26455",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "OX App Suite",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "0",
                          "version_value": "7.10.6-rev48"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "OX Software GmbH"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-287",
                "lang": "eng",
                "value": "CWE-287 Improper Authentication"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf",
            "refsource": "MISC",
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf"
          },
          {
            "name": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json",
            "refsource": "MISC",
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json"
          }
        ]
      },
      "source": {
        "defect": [
          "MWB-1996"
        ],
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "59D4F30E-2F52-4948-9C69-C57472833C79",
                    "versionEndExcluding": "7.10.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:-:*:*:*:*:*:*",
                    "matchCriteriaId": "A144D75D-60A8-4EE0-813C-F658C626B2AA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6069:*:*:*:*:*:*",
                    "matchCriteriaId": "2DA66230-DE02-4881-A893-E9E78286B157",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6073:*:*:*:*:*:*",
                    "matchCriteriaId": "955F3DFB-6479-4867-B62A-82730DBEB498",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6080:*:*:*:*:*:*",
                    "matchCriteriaId": "327D1B56-0D05-4D99-91D4-CC1F0AC32972",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6085:*:*:*:*:*:*",
                    "matchCriteriaId": "D0CD0684-C431-47F8-A2F4-1936D5C5A72B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6093:*:*:*:*:*:*",
                    "matchCriteriaId": "EAA6A4A7-C1EE-4716-9F4D-2FF4C4D5FEC8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6102:*:*:*:*:*:*",
                    "matchCriteriaId": "D0968764-CCEE-47A7-9111-E106D887DA43",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6112:*:*:*:*:*:*",
                    "matchCriteriaId": "16589FBB-F0CD-4041-8141-5C89FCCA72AF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6121:*:*:*:*:*:*",
                    "matchCriteriaId": "3CB877EE-A5FE-4FF7-9D21-5C1CFA7343D4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6133:*:*:*:*:*:*",
                    "matchCriteriaId": "0DF5FB90-8D6D-4F99-B454-411B1DFFA630",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6138:*:*:*:*:*:*",
                    "matchCriteriaId": "F58876B9-6C2E-4048-A793-B441A84E86F5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6141:*:*:*:*:*:*",
                    "matchCriteriaId": "D5F177CB-CC45-45A0-9D02-C14A13ECC7A3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6146:*:*:*:*:*:*",
                    "matchCriteriaId": "A89A4192-54E9-4899-8C7B-6C7F7E650D5C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6147:*:*:*:*:*:*",
                    "matchCriteriaId": "F2DC1357-9CD5-415F-A190-2F3F4498EF96",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6148:*:*:*:*:*:*",
                    "matchCriteriaId": "D78ACF64-2802-44DD-AF7A-1BD5EA7F9908",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6150:*:*:*:*:*:*",
                    "matchCriteriaId": "E8F675FA-1684-413A-B1BE-1C5434AC2862",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6156:*:*:*:*:*:*",
                    "matchCriteriaId": "F3F1FDC3-35B2-4BDB-A685-75BC72588179",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6161:*:*:*:*:*:*",
                    "matchCriteriaId": "5B1E509D-2F41-4296-86D2-6BD71783060F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6166:*:*:*:*:*:*",
                    "matchCriteriaId": "AC93EA37-F341-45EC-B651-4F326FB8C613",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6173:*:*:*:*:*:*",
                    "matchCriteriaId": "1A4DB8A6-1702-462C-BFCB-39F91D2EFCE1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6176:*:*:*:*:*:*",
                    "matchCriteriaId": "FC0AEFDB-D033-47FC-93FC-8652F922BB8C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6178:*:*:*:*:*:*",
                    "matchCriteriaId": "B5354768-6527-43C2-B492-A8C14AB4E784",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6189:*:*:*:*:*:*",
                    "matchCriteriaId": "D83F26D1-B8C6-4114-81EC-810DD5412DC8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6194:*:*:*:*:*:*",
                    "matchCriteriaId": "E9EBC010-9963-4636-96F7-A121FCF755A7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6199:*:*:*:*:*:*",
                    "matchCriteriaId": "F626D64B-C301-4CD8-94B4-48689BD3F29C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6204:*:*:*:*:*:*",
                    "matchCriteriaId": "5E32810C-7B35-42F1-BCA5-E10C02BE2215",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6205:*:*:*:*:*:*",
                    "matchCriteriaId": "6539D059-8614-4C26-93C4-C2DDCC5D35E2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6209:*:*:*:*:*:*",
                    "matchCriteriaId": "E359EE75-A2F9-479B-B757-CAE1064AB8F4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6210:*:*:*:*:*:*",
                    "matchCriteriaId": "0BCABDEF-D292-406E-B53C-AFF22484E916",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6214:*:*:*:*:*:*",
                    "matchCriteriaId": "ABE8872C-B1DD-4A45-8EF8-E8C355CA6C54",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6215:*:*:*:*:*:*",
                    "matchCriteriaId": "44B20B83-833A-4C68-8693-365BD046C157",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6216:*:*:*:*:*:*",
                    "matchCriteriaId": "E254E6D1-D18E-4A2A-A2FF-7D03F39E65DD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6218:*:*:*:*:*:*",
                    "matchCriteriaId": "5F0C5E53-4D15-425A-B4CF-5869353724BF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6219:*:*:*:*:*:*",
                    "matchCriteriaId": "2F4BF5F1-F316-4BAC-83E0-DEAC8C50754E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6220:*:*:*:*:*:*",
                    "matchCriteriaId": "5CDD03A8-5B86-4B87-9C29-6C967261C5C0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6227:*:*:*:*:*:*",
                    "matchCriteriaId": "6071E15F-4D59-41DC-A4D4-7D1AA392A1F2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6230:*:*:*:*:*:*",
                    "matchCriteriaId": "C72C1CEB-7BF7-4A5F-B2E9-397F86CCBF4E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6233:*:*:*:*:*:*",
                    "matchCriteriaId": "5B0F0218-4224-4084-B38D-9719D3782C03",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6235:*:*:*:*:*:*",
                    "matchCriteriaId": "BFC41329-1AD6-4575-A22D-977EC5539DA4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6236:*:*:*:*:*:*",
                    "matchCriteriaId": "217A06B7-0823-4508-BC0C-AD792BA88F7B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6239:*:*:*:*:*:*",
                    "matchCriteriaId": "246E98B2-A6C8-4410-AA6A-7E81EE8C5E76",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6241:*:*:*:*:*:*",
                    "matchCriteriaId": "74D1EC02-D009-45DA-B1EC-2219E0F0183C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.\n\n"
          },
          {
            "lang": "es",
            "value": "RMI no requer\u00eda autenticaci\u00f3n al llamar a ChronosRMIService:setEventOrganizer. Los atacantes con acceso a la red local o adyacente podr\u00edan abusar del servicio RMI para modificar elementos del calendario utilizando RMI. El acceso RMI est\u00e1 restringido a localhost de forma predeterminada. La interfaz se ha actualizada para requerir solicitudes autenticadas. No se conocen exploits disponibles p\u00fablicamente."
          }
        ],
        "id": "CVE-2023-26455",
        "lastModified": "2024-01-12T08:15:42.813",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 5.6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 4.7,
              "source": "security@open-xchange.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2023-11-02T14:15:10.873",
        "references": [
          {
            "source": "security@open-xchange.com",
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json"
          },
          {
            "source": "security@open-xchange.com",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf"
          }
        ],
        "sourceIdentifier": "security@open-xchange.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "security@open-xchange.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.