CVE-2022-37313: SSRF
Published Dec 26, 2022
·Updated
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.
Affected Software
53 affected components
Open-Xchange Open-Xchange AppSuite<7.10.5
Open-Xchange Open-Xchange AppSuite=7.10.5
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5961
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5973
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5976
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5982
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5989
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_5994
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6000
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6003
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6008
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6010
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6016
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6020
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6026
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6029
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6034
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6035
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6038
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6046
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6051
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6053
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6060
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6061
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6066
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6068
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6072
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6079
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6084
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6092
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6101
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6111
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6120
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6132
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6137
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6140
Open-Xchange Open-Xchange AppSuite=7.10.5-patch_release_6149
Open-Xchange Open-Xchange AppSuite=7.10.6
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6069
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6073
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6080
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6085
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6093
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6102
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6112
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6121
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6133
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6138
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6141
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6146
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6147
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6148
Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6150
Event History
Dec 26, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-37313?
CVE-2022-37313 has a medium severity rating due to its potential for server-side request forgery (SSRF).
2
How do I fix CVE-2022-37313?
To fix CVE-2022-37313, upgrade to Open-Xchange App Suite version 7.10.7 or later, which includes the necessary patches.
3
What software is affected by CVE-2022-37313?
CVE-2022-37313 affects Open-Xchange App Suite versions up to 7.10.6.
4
What is SSRF in the context of CVE-2022-37313?
In the context of CVE-2022-37313, SSRF refers to a vulnerability that allows an attacker to make requests to internal resources from the vulnerable server.
5
Can CVE-2022-37313 be exploited remotely?
Yes, CVE-2022-37313 can be exploited remotely without authentication, making it critical to address promptly.