CVE-2023-26454: SQL Injection
First published: Thu Nov 02 2023(Updated: )
Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.
Credit: security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-Xchange App Suite Backend | <7.10.6 | |
| Open-Xchange App Suite Backend | =7.10.6 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6069 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6073 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6080 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6085 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6093 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6102 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6112 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6121 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6133 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6138 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6141 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6146 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6147 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6148 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6150 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6156 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6161 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6166 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6173 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6176 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6178 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6189 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6194 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6199 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6204 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6205 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6209 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6210 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6214 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6215 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6216 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6218 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6219 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6220 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6227 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6230 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6233 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6235 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6236 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6239 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6241 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-26454?
CVE-2023-26454 is a vulnerability that allows for the inclusion of SQL queries in image metadata requests, which can be exploited to execute arbitrary SQL statements.
What is the severity of CVE-2023-26454?
The severity of CVE-2023-26454 is high, with a severity value of 8.8.
Which software is affected by CVE-2023-26454?
Open-xchange Open-xchange Appsuite versions up to and including 7.10.6 are affected by CVE-2023-26454.
What is the recommended solution for CVE-2023-26454?
To mitigate CVE-2023-26454, it is recommended to update to Open-xchange Open-xchange Appsuite version 7.10.6-patch_release_6243 or later.
Where can I find more information about CVE-2023-26454?
More information about CVE-2023-26454 can be found in the Open-xchange Open-xchange Appsuite release notes and the corresponding security advisory.
- agent/type
- agent/event
- agent/first-publish-date
- agent/author
- agent/weakness
- agent/references
- agent/severity
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/open-xchange
- canonical/open-xchange app suite backend
- version/open-xchange app suite backend/7.10.6
- version/open-xchange app suite backend/7.10.6-patch_release_6069
- version/open-xchange app suite backend/7.10.6-patch_release_6073
- version/open-xchange app suite backend/7.10.6-patch_release_6080
- version/open-xchange app suite backend/7.10.6-patch_release_6085
- version/open-xchange app suite backend/7.10.6-patch_release_6093
- version/open-xchange app suite backend/7.10.6-patch_release_6102
- version/open-xchange app suite backend/7.10.6-patch_release_6112
- version/open-xchange app suite backend/7.10.6-patch_release_6121
- version/open-xchange app suite backend/7.10.6-patch_release_6133
- version/open-xchange app suite backend/7.10.6-patch_release_6138
- version/open-xchange app suite backend/7.10.6-patch_release_6141
- version/open-xchange app suite backend/7.10.6-patch_release_6146
- version/open-xchange app suite backend/7.10.6-patch_release_6147
- version/open-xchange app suite backend/7.10.6-patch_release_6148
- version/open-xchange app suite backend/7.10.6-patch_release_6150
- version/open-xchange app suite backend/7.10.6-patch_release_6156
- version/open-xchange app suite backend/7.10.6-patch_release_6161
- version/open-xchange app suite backend/7.10.6-patch_release_6166
- version/open-xchange app suite backend/7.10.6-patch_release_6173
- version/open-xchange app suite backend/7.10.6-patch_release_6176
- version/open-xchange app suite backend/7.10.6-patch_release_6178
- version/open-xchange app suite backend/7.10.6-patch_release_6189
- version/open-xchange app suite backend/7.10.6-patch_release_6194
- version/open-xchange app suite backend/7.10.6-patch_release_6199
- version/open-xchange app suite backend/7.10.6-patch_release_6204
- version/open-xchange app suite backend/7.10.6-patch_release_6205
- version/open-xchange app suite backend/7.10.6-patch_release_6209
- version/open-xchange app suite backend/7.10.6-patch_release_6210
- version/open-xchange app suite backend/7.10.6-patch_release_6214
- version/open-xchange app suite backend/7.10.6-patch_release_6215
- version/open-xchange app suite backend/7.10.6-patch_release_6216
- version/open-xchange app suite backend/7.10.6-patch_release_6218
- version/open-xchange app suite backend/7.10.6-patch_release_6219
- version/open-xchange app suite backend/7.10.6-patch_release_6220
- version/open-xchange app suite backend/7.10.6-patch_release_6227
- version/open-xchange app suite backend/7.10.6-patch_release_6230
- version/open-xchange app suite backend/7.10.6-patch_release_6233
- version/open-xchange app suite backend/7.10.6-patch_release_6235
- version/open-xchange app suite backend/7.10.6-patch_release_6236
- version/open-xchange app suite backend/7.10.6-patch_release_6239
- version/open-xchange app suite backend/7.10.6-patch_release_6241