PT-2023-20628 · Ox Software Gmbh+1 · Ox App Suite+1

Mdisec · CVE-2023-26431 · Publicado 2023-06-20 · Atualizado 2026-04-05

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue arises from the code not recognizing IPv4-mapped IPv6 addresses as "local", leading to a connection attempt. This could be exploited by attackers with user account access to bypass deny-list functionality, allowing them to gain insights into network topology and running services by triggering requests to restricted infrastructure. The code now respects possible IPv4-mapped IPv6 addresses when checking deny-lists.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2023-26431

Produtos afetados

Ox App Suite

Open-Xchange Appsuite Backend

Referências · 9

• https://t.me/cvenotify/52855 · Publicação no Telegram
• https://t.me/cvenotify/67178 · Publicação no Telegram
• http://seclists.org/fulldisclosure/2023/Jun/8 · Nota
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26431 · Aviso do Fabricante
• http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html · Nota
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-26431 · Nota de Segurança
• https://twitter.com/dailycve/status/2040715868171059387 · Publicação no Twitter