CVE-2023-26451
First published: Wed Aug 02 2023(Updated: )
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.
Credit: security@open-xchange.com security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <=8.11.0 | ||
| Open-xchange Open-xchange Appsuite Backend | <=8.11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
- http://seclists.org/fulldisclosure/2023/Aug/8
- http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html
- https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-26451.
What is the severity of CVE-2023-26451?
The severity of CVE-2023-26451 is high with a severity value of 7.5.
What software versions are affected by CVE-2023-26451?
Open-xchange Open-xchange Appsuite Backend versions up to and including 8.11.0 are affected by CVE-2023-26451.
How can an attacker exploit CVE-2023-26451?
An attacker can exploit CVE-2023-26451 by intercepting and taking over the client authorization process using predictable authorization codes generated by functions with insufficient randomness.
Are there any references for CVE-2023-26451?
Yes, you can find references for CVE-2023-26451 here: [Reference 1](https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json), [Reference 2](https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf), [Reference 3](http://seclists.org/fulldisclosure/2023/Aug/8).
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-index
- collector/nvd-latest
- vendor/open-xchange
- canonical/open-xchange open-xchange appsuite backend
- version/open-xchange open-xchange appsuite backend/8.11.0