PT-2023-19707 · Open Xchange · Ox App Suite

Tim Coen · CVE-2023-24605 · Publicado 2023-05-29 · Atualizado 2025-01-14

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OX App Suite versions prior to 7.10.6-rev37

Description The issue concerns the lack of enforcement of two-factor authentication (2FA) for all endpoints in OX App Suite. Specifically, endpoints such as reading from a drive, reading contact data, and renaming tokens are not properly secured with 2FA. This oversight could potentially allow unauthorized access to sensitive data.

Recommendations For versions prior to 7.10.6-rev37, update to version 7.10.6-rev37 or later to ensure 2FA is enforced for all endpoints. As a temporary workaround, consider restricting access to sensitive endpoints, such as those related to drive access, contact data, and token management, until the update can be applied.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-24605

Produtos afetados

Ox App Suite

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24605.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-24605 · Aviso do Fabricante
• https://t.me/cvenotify/51316 · Publicação no Telegram
• https://open-xchange.com · Nota
• http://seclists.org/fulldisclosure/2023/May/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-24605 · Nota de Segurança