CVE-2023-26435 — MEDIUM (5.0)

Q: How severe is CVE-2023-26435?

CVE-2023-26435 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2023-26435?

Check the references section above for vendor advisories and patch information. Affected products include: Open-Xchange Open-Xchange Appsuite Backend.

Vulnerability Description

It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as well as including local files with read permissions of the open-xchange system user. This was limited to specific file-types, like images. We have improved existing content filters and validators to avoid including any local resources. No publicly available exploits are known.

CVSS Score

5.0

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Open-Xchange	Open-Xchange Appsuite Backend	< 7.10.6

Related Weaknesses (CWE)

CWE-918

References

http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-ConsumptiThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2023/Jun/8Mailing ListThird Party Advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/ox
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release Notes
http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-ConsumptiThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2023/Jun/8Mailing ListThird Party Advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/ox
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release Notes

FAQ

What is CVE-2023-26435?

CVE-2023-26435 is a vulnerability with a CVSS score of 5.0 (MEDIUM). It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as wel...

How severe is CVE-2023-26435?

CVE-2023-26435 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-26435?

Check the references section above for vendor advisories and patch information. Affected products include: Open-Xchange Open-Xchange Appsuite Backend.