Low severity · published Aug 2, 2023
CVE-2023-26442
In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend
3.2
CVSS
0.4%
EPSS
No
On KEV
Description
In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources. No publicly available exploits are known.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
OX App Suite · OX Software GmbH
through 8.10 · source: vendor
OA
Open-xchange Appsuite Office · Open-xchange
before 8.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26442
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26442
Third Party Advisory
http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html
Mailing List
http://seclists.org/fulldisclosure/2023/Aug/8
documentation.open-xchange.com
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
Release Notes
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf
More from OX App Suite
9.8
CVE-2023-26443
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements
8.8
CVE-2023-26454
Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked
8.8
CVE-2023-26453
Requests to cache an image could be abused to include SQL queries that would be executed unchecked
8.8
CVE-2023-26452
Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked
8.8
CVE-2023-26436
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization