CVE-2023-26427
First published: Tue Jun 20 2023(Updated: )
Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known.
Credit: security@open-xchange.com security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <7.10.6 | ||
| =7.10.6 | ||
| =7.10.6-revision_39 | ||
| Open-xchange Open-xchange Appsuite Backend | <7.10.6 | |
| Open-xchange Open-xchange Appsuite Backend | =7.10.6 | |
| Open-xchange Open-xchange Appsuite Backend | =7.10.6-revision_39 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
- http://seclists.org/fulldisclosure/2023/Jun/8
- http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html
- https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0002.json
Frequently Asked Questions
What is CVE-2023-26427?
CVE-2023-26427 is a vulnerability that occurs due to default permissions for a properties file being too permissive, allowing local system users to read potentially sensitive information.
What software is affected by CVE-2023-26427?
Open-xchange Appsuite Backend versions up to and including 7.10.6-revision_39 are affected by CVE-2023-26427.
How severe is CVE-2023-26427?
CVE-2023-26427 has a severity level of low (3.3) on the CVSS scale.
Are there any publicly available exploits for CVE-2023-26427?
No, there are no publicly available exploits known for CVE-2023-26427.
How can CVE-2023-26427 be fixed?
CVE-2023-26427 can be fixed by updating the default permissions for noreply.properties during package installation.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-index
- vendor/open-xchange
- canonical/open-xchange open-xchange appsuite backend
- version/open-xchange open-xchange appsuite backend/7.10.6
- version/open-xchange open-xchange appsuite backend/7.10.6-revision_39