CVE-2023-26430: Command Injection
First published: Wed Aug 02 2023(Updated: )
Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules. We have added sanitization to all mail-filter APIs to avoid forwardning control characters to subsystems. No publicly available exploits are known.
Credit: security@open-xchange.com security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| =7.10.6 | ||
| =8.10.0 | ||
| Open-xchange Open-xchange Appsuite Backend | =7.10.6 | |
| Open-xchange Open-xchange Appsuite Backend | =8.10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
- http://seclists.org/fulldisclosure/2023/Aug/8
- http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html
- https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json
Frequently Asked Questions
What is CVE-2023-26430?
CVE-2023-26430 is a vulnerability in Open-Xchange Appsuite Backend that allows attackers with access to user accounts to inject arbitrary control characters to SIEVE mail-filter rules.
What is the severity of CVE-2023-26430?
CVE-2023-26430 has a severity rating of medium, with a score of 4.3.
Which software versions are affected by CVE-2023-26430?
CVE-2023-26430 affects Open-Xchange Appsuite Backend versions 7.10.6 and 8.10.0.
How can the vulnerability be exploited?
The vulnerability can be exploited by attackers with access to user accounts who inject arbitrary control characters to SIEVE mail-filter rules.
Are there any references for CVE-2023-26430?
Yes, you can find references for CVE-2023-26430 in the following sources: [Link 1](https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json), [Link 2](https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf), [Link 3](http://seclists.org/fulldisclosure/2023/Aug/8).
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-index
- collector/nvd-latest
- vendor/open-xchange
- canonical/open-xchange open-xchange appsuite backend
- version/open-xchange open-xchange appsuite backend/7.10.6
- version/open-xchange open-xchange appsuite backend/8.10.0