CVE-2023-26454: SQL Injection

Q: What is CVE-2023-26454?

CVE-2023-26454 is a vulnerability that allows for the inclusion of SQL queries in image metadata requests, which can be exploited to execute arbitrary SQL statements.

Q: What is the severity of CVE-2023-26454?

The severity of CVE-2023-26454 is high, with a severity value of 8.8.

Q: Which software is affected by CVE-2023-26454?

Open-xchange Open-xchange Appsuite versions up to and including 7.10.6 are affected by CVE-2023-26454.

Q: What is the recommended solution for CVE-2023-26454?

To mitigate CVE-2023-26454, it is recommended to update to Open-xchange Open-xchange Appsuite version 7.10.6-patch_release_6243 or later.

Q: Where can I find more information about CVE-2023-26454?

More information about CVE-2023-26454 can be found in the Open-xchange Open-xchange Appsuite release notes and the corresponding security advisory.

Published Nov 2, 2023

Updated

Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.

Affected Software

43 affected components

Open-Xchange Open-Xchange AppSuite<7.10.6

Open-Xchange Open-Xchange AppSuite=7.10.6

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6069

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6073

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6080

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6085

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6093

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6102

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6112

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6121

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6133

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6138

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6141

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6146

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6147

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6148

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6150

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6156

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6161

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6166

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6173

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6176

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6178

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6189

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6194

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6199

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6204

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6205

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6209

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6210

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6214

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6215

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6216

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6218

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6219

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6220

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6227

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6230

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6233

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6235

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6236

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6239

Open-Xchange Open-Xchange AppSuite=7.10.6-patch_release_6241

Event History

Nov 2, 2023

CVE Published

01:01 PM

Data Sourced

01:01 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-26454?

CVE-2023-26454 is a vulnerability that allows for the inclusion of SQL queries in image metadata requests, which can be exploited to execute arbitrary SQL statements.

What is the severity of CVE-2023-26454?

The severity of CVE-2023-26454 is high, with a severity value of 8.8.

Which software is affected by CVE-2023-26454?

Open-xchange Open-xchange Appsuite versions up to and including 7.10.6 are affected by CVE-2023-26454.

What is the recommended solution for CVE-2023-26454?

To mitigate CVE-2023-26454, it is recommended to update to Open-xchange Open-xchange Appsuite version 7.10.6-patch_release_6243 or later.

Where can I find more information about CVE-2023-26454?