CVE-2023-26451: High severity open-xchange app suite backend vulnerability
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-26451.
What is the severity of CVE-2023-26451?
The severity of CVE-2023-26451 is high with a severity value of 7.5.
What software versions are affected by CVE-2023-26451?
Open-xchange Open-xchange Appsuite Backend versions up to and including 8.11.0 are affected by CVE-2023-26451.
How can an attacker exploit CVE-2023-26451?
An attacker can exploit CVE-2023-26451 by intercepting and taking over the client authorization process using predictable authorization codes generated by functions with insufficient randomness.
Are there any references for CVE-2023-26451?
Yes, you can find references for CVE-2023-26451 here: [Reference 1](https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json), [Reference 2](https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf), [Reference 3](http://seclists.org/fulldisclosure/2023/Aug/8).