CVE-2023-26440: SQL Injection
The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary SQL queries. We have improved the input check for API calls and filter for potentially malicious content. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-26440?
CVE-2023-26440 is a vulnerability in the cacheservice API of Open-xchange Appsuite Office that could be exploited to perform arbitrary SQL queries.
How severe is CVE-2023-26440?
CVE-2023-26440 has a severity score of 7.8, which is considered high.
What is the affected software for CVE-2023-26440?
Open-xchange Appsuite Office version up to and exclusive of 8.11 is affected by CVE-2023-26440.
How can CVE-2023-26440 be fixed?
To fix CVE-2023-26440, update to Open-xchange Appsuite Office version 8.11 or later.
Where can I find more information about CVE-2023-26440?
More information about CVE-2023-26440 can be found in the following references: [link1], [link2], [link3].