oxas-adv-2023-0003
Vulnerability from csaf_ox
Published
2023-05-02 00:00
Modified
2024-01-22 00:00
Summary
OX App Suite Security Advisory OXAS-ADV-2023-0003
{
"document": {
"aggregate_severity": {
"text": "CRITICAL"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"lang": "en-US",
"publisher": {
"category": "vendor",
"name": "Open-Xchange GmbH",
"namespace": "https://open-xchange.com/"
},
"references": [
{
"category": "external",
"summary": "Release Notes",
"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf"
},
{
"category": "self",
"summary": "Canonical CSAF document",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json"
},
{
"category": "self",
"summary": "Markdown representation",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/md/2023/oxas-adv-2023-0003.md"
},
{
"category": "self",
"summary": "HTML representation",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/html/2023/oxas-adv-2023-0003.html"
},
{
"category": "self",
"summary": "Plain-text representation",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/txt/2023/oxas-adv-2023-0003.txt"
}
],
"title": "OX App Suite Security Advisory OXAS-ADV-2023-0003",
"tracking": {
"current_release_date": "2024-01-22T00:00:00+00:00",
"generator": {
"date": "2024-01-22T13:14:23+00:00",
"engine": {
"name": "OX CSAF",
"version": "1.0.0"
}
},
"id": "OXAS-ADV-2023-0003",
"initial_release_date": "2023-05-02T00:00:00+02:00",
"revision_history": [
{
"date": "2023-05-02T00:00:00+02:00",
"number": "1",
"summary": "Initial release"
},
{
"date": "2024-01-22T00:00:00+00:00",
"number": "2",
"summary": "Public release"
},
{
"date": "2024-01-22T00:00:00+00:00",
"number": "3",
"summary": "Public release"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "7.10.6-rev27",
"product": {
"name": "OX App Suite frontend 7.10.6-rev27",
"product_id": "OXAS-FRONTEND_7.10.6-rev27",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev27:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "7.10.6-rev28",
"product": {
"name": "OX App Suite frontend 7.10.6-rev28",
"product_id": "OXAS-FRONTEND_7.10.6-rev28",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev28:*:*:*:*:*:*",
"x_generic_uris": [
{
"namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
"uri": "urn:open-xchange:app_suite:patch-id:6230"
}
]
}
}
},
{
"category": "product_version",
"name": "8.11",
"product": {
"name": "OX App Suite frontend 8.11",
"product_id": "OXAS-FRONTEND_8.11",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:8.11:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "8.12",
"product": {
"name": "OX App Suite frontend 8.12",
"product_id": "OXAS-FRONTEND_8.12",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:8.12:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "7.6.3-rev52",
"product": {
"name": "OX App Suite frontend 7.6.3-rev52",
"product_id": "OXAS-FRONTEND_7.6.3-rev52",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev52:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "7.6.3-rev53",
"product": {
"name": "OX App Suite frontend 7.6.3-rev53",
"product_id": "OXAS-FRONTEND_7.6.3-rev53",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:7.6.3:rev53:*:*:*:*:*:*",
"x_generic_uris": [
{
"namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
"uri": "urn:open-xchange:app_suite:patch-id:6230"
}
]
}
}
},
{
"category": "product_version",
"name": "7.10.6-rev29",
"product": {
"name": "OX App Suite frontend 7.10.6-rev29",
"product_id": "OXAS-FRONTEND_7.10.6-rev29",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev29:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "7.10.6-rev30",
"product": {
"name": "OX App Suite frontend 7.10.6-rev30",
"product_id": "OXAS-FRONTEND_7.10.6-rev30",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev30:*:*:*:*:*:*",
"x_generic_uris": [
{
"namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
"uri": "urn:open-xchange:app_suite:patch-id:6230"
}
]
}
}
}
],
"category": "product_name",
"name": "OX App Suite frontend"
},
{
"branches": [
{
"category": "product_version",
"name": "7.10.6-rev42",
"product": {
"name": "OX App Suite backend 7.10.6-rev42",
"product_id": "OXAS-BACKEND_7.10.6-rev42",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev42:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "8.10",
"product": {
"name": "OX App Suite backend 8.10",
"product_id": "OXAS-BACKEND_8.10",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:8.10:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "7.10.6-rev43",
"product": {
"name": "OX App Suite backend 7.10.6-rev43",
"product_id": "OXAS-BACKEND_7.10.6-rev43",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev43:*:*:*:*:*:*",
"x_generic_uris": [
{
"namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
"uri": "urn:open-xchange:app_suite:patch-id:6230"
}
]
}
}
},
{
"category": "product_version",
"name": "8.11",
"product": {
"name": "OX App Suite backend 8.11",
"product_id": "OXAS-BACKEND_8.11",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:8.11:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "8.12",
"product": {
"name": "OX App Suite backend 8.12",
"product_id": "OXAS-BACKEND_8.12",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:app_suite:8.12:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "OX App Suite backend"
},
{
"branches": [
{
"category": "product_version",
"name": "8.10",
"product": {
"name": "OX App Suite office 8.10",
"product_id": "OXAS-OFFICE_8.10",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:office:8.10:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "8.11",
"product": {
"name": "OX App Suite office 8.11",
"product_id": "OXAS-OFFICE_8.11",
"product_identification_helper": {
"cpe": "cpe:2.3:a:open-xchange:office:8.11:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "OX App Suite office"
}
],
"category": "vendor",
"name": "Open-Xchange GmbH"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-26445",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2023-03-20T17:38:29+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "OXUIB-2282"
}
],
"notes": [
{
"category": "description",
"text": "Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login."
}
],
"product_status": {
"first_fixed": [
"OXAS-FRONTEND_7.10.6-rev28"
],
"last_affected": [
"OXAS-FRONTEND_7.10.6-rev27"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-04-20T07:00:48+02:00",
"details": "Please deploy the provided updates and patch releases. We now sanitize the theme value and use a default fallback if no theme matches.",
"product_ids": [
"OXAS-FRONTEND_7.10.6-rev27"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"OXAS-FRONTEND_7.10.6-rev27"
]
}
],
"threats": [
{
"category": "impact",
"details": "Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "Themes can be abused to inject script code for persistent XSS"
},
{
"cve": "CVE-2023-26446",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2023-03-20T17:47:00+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "OXUIB-2283"
}
],
"notes": [
{
"category": "description",
"text": "The users clientID at \"application passwords\" was not sanitized or escaped before being added to DOM."
}
],
"product_status": {
"first_fixed": [
"OXAS-FRONTEND_7.10.6-rev28",
"OXAS-FRONTEND_8.12"
],
"last_affected": [
"OXAS-FRONTEND_7.10.6-rev27",
"OXAS-FRONTEND_8.11"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-04-20T06:55:06+02:00",
"details": "Please deploy the provided updates and patch releases. We now sanitize the user-controllable clientID parameter.",
"product_ids": [
"OXAS-FRONTEND_7.10.6-rev27",
"OXAS-FRONTEND_8.11"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OXAS-FRONTEND_7.10.6-rev27",
"OXAS-FRONTEND_8.11"
]
}
],
"threats": [
{
"category": "impact",
"details": "Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "XSS using application passwords \"lastDevice\" property"
},
{
"cve": "CVE-2023-26447",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2023-03-20T17:52:51+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "OXUIB-2284"
}
],
"notes": [
{
"category": "description",
"text": "The \"upsell\" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM."
}
],
"product_status": {
"first_fixed": [
"OXAS-FRONTEND_7.10.6-rev28",
"OXAS-FRONTEND_7.6.3-rev53"
],
"last_affected": [
"OXAS-FRONTEND_7.10.6-rev27",
"OXAS-FRONTEND_7.6.3-rev52"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-04-20T06:50:09+02:00",
"details": "Please deploy the provided updates and patch releases. We now sanitize jslob content.",
"product_ids": [
"OXAS-FRONTEND_7.10.6-rev27",
"OXAS-FRONTEND_7.6.3-rev52"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OXAS-FRONTEND_7.10.6-rev27",
"OXAS-FRONTEND_7.6.3-rev52"
]
}
],
"threats": [
{
"category": "impact",
"details": "Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "XSS in upsell portal widget"
},
{
"cve": "CVE-2023-26448",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2023-03-20T18:05:35+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "OXUIB-2285"
}
],
"notes": [
{
"category": "description",
"text": "Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers."
}
],
"product_status": {
"first_fixed": [
"OXAS-FRONTEND_7.10.6-rev30",
"OXAS-FRONTEND_7.6.3-rev53"
],
"last_affected": [
"OXAS-FRONTEND_7.10.6-rev29",
"OXAS-FRONTEND_7.6.3-rev52"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-06-01T09:24:31+02:00",
"details": "Please deploy the provided updates and patch releases. We now sanitize jslob content for those locations to avoid redirects to malicious content.",
"product_ids": [
"OXAS-FRONTEND_7.10.6-rev29",
"OXAS-FRONTEND_7.6.3-rev52"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OXAS-FRONTEND_7.10.6-rev29",
"OXAS-FRONTEND_7.6.3-rev52"
]
}
],
"threats": [
{
"category": "impact",
"details": "Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "XSS via user-defined login/logout URL"
},
{
"cve": "CVE-2023-26449",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2023-03-20T18:22:07+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "OXUIB-2286"
}
],
"notes": [
{
"category": "description",
"text": "The \"OX Chat\" web service did not specify a media-type when processing responses by external resources."
}
],
"product_status": {
"first_fixed": [
"OXAS-FRONTEND_7.10.6-rev28"
],
"last_affected": [
"OXAS-FRONTEND_7.10.6-rev27"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-04-19T14:59:40+02:00",
"details": "Please deploy the provided updates and patch releases. We are now defining the accepted media-type to avoid code execution.",
"product_ids": [
"OXAS-FRONTEND_7.10.6-rev27"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OXAS-FRONTEND_7.10.6-rev27"
]
}
],
"threats": [
{
"category": "impact",
"details": "Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "XSS by returning user-defined content-type as Chat service resource"
},
{
"cve": "CVE-2023-26450",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2023-03-20T18:35:21+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "OXUIB-2287"
}
],
"notes": [
{
"category": "description",
"text": "The \"OX Count\" web service did not specify a media-type when processing responses by external resources."
}
],
"product_status": {
"first_fixed": [
"OXAS-FRONTEND_7.10.6-rev28"
],
"last_affected": [
"OXAS-FRONTEND_7.10.6-rev27"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-04-19T14:52:23+02:00",
"details": "Please deploy the provided updates and patch releases. We are now defining the accepted media-type to avoid code execution.",
"product_ids": [
"OXAS-FRONTEND_7.10.6-rev27"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OXAS-FRONTEND_7.10.6-rev27"
]
}
],
"threats": [
{
"category": "impact",
"details": "Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "XSS using malicious Count service resource"
},
{
"cve": "CVE-2023-26438",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2022-10-17T10:08:47+02:00",
"ids": [
{
"system_name": "OX Bug",
"text": "MWB-1877"
}
],
"notes": [
{
"category": "description",
"text": "External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists."
}
],
"product_status": {
"first_fixed": [
"OXAS-BACKEND_7.10.6-rev43",
"OXAS-BACKEND_8.11"
],
"last_affected": [
"OXAS-BACKEND_7.10.6-rev42",
"OXAS-BACKEND_8.10"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-04-27T07:11:08+02:00",
"details": "Please deploy the provided updates and patch releases. Improvements were made to include deny-lists not only during the check of the provided connection data, but also during use.",
"product_ids": [
"OXAS-BACKEND_7.10.6-rev42",
"OXAS-BACKEND_8.10"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"OXAS-BACKEND_7.10.6-rev42",
"OXAS-BACKEND_8.10"
]
}
],
"threats": [
{
"category": "impact",
"details": "Attackers could exploit this weakness to discover the existence of restricted network infrastructure and service availability."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "SSRF using DNS rebinding attacks"
},
{
"cve": "CVE-2023-26430",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"discovery_date": "2023-01-23T11:04:33+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "MWB-2020"
}
],
"notes": [
{
"category": "description",
"text": "Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules."
}
],
"product_status": {
"first_fixed": [
"OXAS-BACKEND_7.10.6-rev43",
"OXAS-BACKEND_8.11"
],
"last_affected": [
"OXAS-BACKEND_7.10.6-rev42",
"OXAS-BACKEND_8.10"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-04-26T15:34:13+02:00",
"details": "Please deploy the provided updates and patch releases. We have added sanitization to all mail-filter APIs to avoid forwardning control characters to subsystems.",
"product_ids": [
"OXAS-BACKEND_7.10.6-rev42",
"OXAS-BACKEND_8.10"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"OXAS-BACKEND_7.10.6-rev42",
"OXAS-BACKEND_8.10"
]
}
],
"threats": [
{
"category": "impact",
"details": "This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "Mailfilter (SIEVE) rules accept control characters"
},
{
"cve": "CVE-2023-26443",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2023-03-14T11:16:06+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "MWB-2086"
}
],
"notes": [
{
"category": "description",
"text": "Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements."
}
],
"product_status": {
"first_fixed": [
"OXAS-BACKEND_7.10.6-rev43",
"OXAS-BACKEND_8.12"
],
"last_affected": [
"OXAS-BACKEND_7.10.6-rev42",
"OXAS-BACKEND_8.11"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-04-27T10:59:24+02:00",
"details": "Please deploy the provided updates and patch releases. We now properly encode single quotes for SQL FULLTEXT queries.",
"product_ids": [
"OXAS-BACKEND_7.10.6-rev42",
"OXAS-BACKEND_8.11"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OXAS-BACKEND_7.10.6-rev42",
"OXAS-BACKEND_8.11"
]
}
],
"threats": [
{
"category": "impact",
"details": "With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "Potentially malicious SQL injection when using full-text autocomplete"
},
{
"cve": "CVE-2023-26451",
"cwe": {
"id": "CWE-330",
"name": "Use of Insufficiently Random Values"
},
"discovery_date": "2023-03-27T10:59:24+02:00",
"ids": [
{
"system_name": "OX Bug",
"text": "MWB-2102"
}
],
"notes": [
{
"category": "description",
"text": "Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service."
}
],
"product_status": {
"first_fixed": [
"OXAS-BACKEND_8.12"
],
"last_affected": [
"OXAS-BACKEND_8.11"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-04-28T15:34:38+02:00",
"details": "Please deploy the provided updates and patch releases. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens.",
"product_ids": [
"OXAS-BACKEND_8.11"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OXAS-BACKEND_8.11"
]
}
],
"threats": [
{
"category": "impact",
"details": "Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "oAuth provider uses predictable secret source, allows to take over any oAuth session"
},
{
"cve": "CVE-2023-26439",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2023-02-13T15:22:55+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "DOCS-4726"
}
],
"notes": [
{
"category": "description",
"text": "The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement."
}
],
"product_status": {
"first_fixed": [
"OXAS-OFFICE_8.11"
],
"last_affected": [
"OXAS-OFFICE_8.10"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-03-14T11:36:21+01:00",
"details": "Please deploy the provided updates and patch releases. We have improved the input check for API calls and filter for potentially malicious content.",
"product_ids": [
"OXAS-OFFICE_8.10"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OXAS-OFFICE_8.10"
]
}
],
"threats": [
{
"category": "impact",
"details": "Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discovering other users cached data."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "SQL Injection at Cacheservice \"getObjects\" API"
},
{
"cve": "CVE-2023-26440",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2023-02-13T16:36:09+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "DOCS-4727"
}
],
"notes": [
{
"category": "description",
"text": "The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups."
}
],
"product_status": {
"first_fixed": [
"OXAS-OFFICE_8.11"
],
"last_affected": [
"OXAS-OFFICE_8.10"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Please deploy the provided updates and patch releases. We have improved the input check for API calls and filter for potentially malicious content.",
"product_ids": [
"OXAS-OFFICE_8.10"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OXAS-OFFICE_8.10"
]
}
],
"threats": [
{
"category": "impact",
"details": "Attackers with access to a local or restricted network could perform arbitrary SQL queries."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "SQL Injection at Cacheservice \"registerGroup\" API"
},
{
"cve": "CVE-2023-26441",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2023-02-14T20:13:31+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "DOCS-4728"
}
],
"notes": [
{
"category": "description",
"text": "Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources."
}
],
"product_status": {
"first_fixed": [
"OXAS-OFFICE_8.11"
],
"last_affected": [
"OXAS-OFFICE_8.10"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2023-04-28T09:05:17+02:00",
"details": "Please deploy the provided updates and patch releases. We have improved path validation and make sure that any access is contained to the defined root directory.",
"product_ids": [
"OXAS-OFFICE_8.10"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"OXAS-OFFICE_8.10"
]
}
],
"threats": [
{
"category": "impact",
"details": "An attacker with access to the database and a local or restricted network would be able to read arbitrary local file system resources that are accessible by the services system user account."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "Cacheservices allows local file inclusion/removal through directory traversal"
},
{
"cve": "CVE-2023-26442",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2023-02-15T15:12:15+01:00",
"ids": [
{
"system_name": "OX Bug",
"text": "DOCS-4734"
}
],
"notes": [
{
"category": "description",
"text": "In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend."
}
],
"product_status": {
"first_fixed": [
"OXAS-OFFICE_8.11"
],
"last_affected": [
"OXAS-OFFICE_8.10"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Please deploy the provided updates and patch releases. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources.",
"product_ids": [
"OXAS-OFFICE_8.10"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.2,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"OXAS-OFFICE_8.10"
]
}
],
"threats": [
{
"category": "impact",
"details": "An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources."
},
{
"category": "exploit_status",
"details": "No publicly available exploits are known."
}
],
"title": "Cacheservice HTTP client follow redirect responses, allowing SSRF"
}
]
}
Loading...