CVE-2023-26439: SQL Injection
First published: Wed Aug 02 2023(Updated: )
The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discovering other users cached data. We have improved the input check for API calls and filter for potentially malicious content. No publicly available exploits are known.
Credit: security@open-xchange.com security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <8.11 | ||
| Open-xchange Open-xchange Appsuite Office | <8.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
- http://seclists.org/fulldisclosure/2023/Aug/8
- http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html
- https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json
Frequently Asked Questions
What is CVE-2023-26439?
CVE-2023-26439 is a vulnerability in the cacheservice API of Open-xchange Appsuite Office that allows attackers to inject SQL syntax and perform arbitrary SQL queries.
How can the cacheservice API be abused?
The cacheservice API can be abused by injecting parameters with SQL syntax that is not properly sanitized before being executed as an SQL statement.
What is the impact of CVE-2023-26439?
Attackers with access to a local or restricted network can perform arbitrary SQL queries and potentially access other users' cached data.
How severe is the vulnerability CVE-2023-26439?
The severity of CVE-2023-26439 is high, with a severity value of 7.6.
How can I fix the vulnerability CVE-2023-26439?
To fix the vulnerability, it is recommended to update to a patched version of Open-xchange Appsuite Office, such as version 8.11 or later.
- collector/nvd-latest
- collector/nvd-index
- agent/author
- agent/type
- agent/weakness
- agent/references
- agent/severity
- agent/softwarecombine
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/source
- vendor/open-xchange
- canonical/open-xchange open-xchange appsuite office