PT-2023-20634 · Unknown · Cacheservice

Mdisec + 1 · Publicado 2023-08-02 · Atualizado 2024-01-12 · CVE-2023-26441

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Média

Vetor base

AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cacheservice (affected versions not specified)

Description The issue arises from the Cacheservice not correctly checking if relative cache objects point to the defined absolute location when accessing resources. This allows an attacker with access to the database and a local or restricted network to read arbitrary local file system resources accessible by the service's system user account. The problem has been addressed by improving path validation to ensure access is contained within the defined root directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Information Disclosure

Enumeração de Fraquezas

CWE-22

CWE-200

Identificadores relacionados

CVE-2023-26441

Produtos afetados

Cacheservice

Referências · 8

• http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html · Nota
• https://t.me/cvenotify/56016 · Publicação no Telegram
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-26441 · Nota de Segurança
• https://t.me/cibsecurity/67576 · Publicação no Telegram
• http://seclists.org/fulldisclosure/2023/Aug/8 · Nota
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26441 · Aviso do Fabricante