CVE-2023-26440: SQL Injection
First published: Wed Aug 02 2023(Updated: )
The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary SQL queries. We have improved the input check for API calls and filter for potentially malicious content. No publicly available exploits are known.
Credit: security@open-xchange.com security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <8.11 | ||
| Open-xchange Open-xchange Appsuite Office | <8.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
- http://seclists.org/fulldisclosure/2023/Aug/8
- http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html
- https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json
Frequently Asked Questions
What is CVE-2023-26440?
CVE-2023-26440 is a vulnerability in the cacheservice API of Open-xchange Appsuite Office that could be exploited to perform arbitrary SQL queries.
How severe is CVE-2023-26440?
CVE-2023-26440 has a severity score of 7.8, which is considered high.
What is the affected software for CVE-2023-26440?
Open-xchange Appsuite Office version up to and exclusive of 8.11 is affected by CVE-2023-26440.
How can CVE-2023-26440 be fixed?
To fix CVE-2023-26440, update to Open-xchange Appsuite Office version 8.11 or later.
Where can I find more information about CVE-2023-26440?
More information about CVE-2023-26440 can be found in the following references: [link1], [link2], [link3].
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-index
- collector/nvd-latest
- vendor/open-xchange
- canonical/open-xchange open-xchange appsuite office