CVE-2023-26436: Code Injection
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processing the request. A check has been introduced to restrict processing of legal and expected classes for this API. We now log a warning in case there are attempts to inject illegal classes. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-26436.
What is the severity of CVE-2023-26436?
The severity of CVE-2023-26436 is high.
What is the affected software?
The affected software is Open-xchange Open-xchange Appsuite Backend 7.10.6-revision_39 and lower.
How can attackers exploit CVE-2023-26436?
Attackers with access to the "documentconverterws" API can inject serialized Java objects that are not properly checked during deserialization, allowing them to execute arbitrary code.
Are there any references for CVE-2023-26436?
Yes, you can find references for CVE-2023-26436 at the following links: [link1], [link2], [link3].