CVE-2024-23193: Infoleak
First published: Mon May 06 2024(Updated: )
E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters. Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions. No publicly available exploits are known.
Credit: security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-Xchange App Suite Backend | <8.22 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-23193?
CVE-2024-23193 has a severity rating classified as high due to the potential for unauthorized access to users' email data.
What vulnerable versions are affected by CVE-2024-23193?
CVE-2024-23193 affects Open-Xchange OX App Suite versions up to 8.22.
How do I fix CVE-2024-23193?
To fix CVE-2024-23193, update your Open-Xchange OX App Suite to the latest version that addresses the cache-related vulnerabilities.
What are the implications of CVE-2024-23193?
CVE-2024-23193 allows users on the same service node to potentially access other users' email PDFs if exported and cached.
Is my data safe with CVE-2024-23193?
No, data may not be safe as CVE-2024-23193 could lead to temporary exposure of sensitive emails to other users.
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/open-xchange
- canonical/open-xchange app suite backend