Medium severity · published Nov 2, 2023
CVE-2023-29046
Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
OX App Suite · OX Software GmbH
through 7.10.6-rev48; through 8.11 · source: vendor
OA
Open-xchange Appsuite · Open-xchange
before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-29046
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-29046
documentation.open-xchange.com
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
Release Notes
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf
More from OX App Suite
9.8
CVE-2023-26443
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements
8.8
CVE-2023-26454
Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked
8.8
CVE-2023-26453
Requests to cache an image could be abused to include SQL queries that would be executed unchecked
8.8
CVE-2023-26452
Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked
8.8
CVE-2023-26436
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization
