CVE-2023-26430: Command Injection
Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules. We have added sanitization to all mail-filter APIs to avoid forwardning control characters to subsystems. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-26430?
CVE-2023-26430 is a vulnerability in Open-Xchange Appsuite Backend that allows attackers with access to user accounts to inject arbitrary control characters to SIEVE mail-filter rules.
What is the severity of CVE-2023-26430?
CVE-2023-26430 has a severity rating of medium, with a score of 4.3.
Which software versions are affected by CVE-2023-26430?
CVE-2023-26430 affects Open-Xchange Appsuite Backend versions 7.10.6 and 8.10.0.
How can the vulnerability be exploited?
The vulnerability can be exploited by attackers with access to user accounts who inject arbitrary control characters to SIEVE mail-filter rules.
Are there any references for CVE-2023-26430?
Yes, you can find references for CVE-2023-26430 in the following sources: [Link 1](https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json), [Link 2](https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf), [Link 3](http://seclists.org/fulldisclosure/2023/Aug/8).