PT-2023-20644 · Softwarex · Softwarex

Eldar Zeynalli + 1 · Publicado 2023-08-02 · Atualizado 2024-01-12 · CVE-2023-26451

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SoftwareX (affected versions not specified)

Description The issue is related to the integrated oAuth Authorization Service, where functions with insufficient randomness were used to generate authorization tokens. This made authorization codes predictable for third parties, allowing them to intercept and take over the client authorization process, potentially compromising other users' accounts. The oAuth Authorization Service is not enabled by default. The implementation has been updated to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2023-26451

Produtos afetados

Softwarex

Referências · 8

• https://t.me/cibsecurity/67588 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26451 · Nota de Segurança
• http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html · Nota
• https://osv.dev/vulnerability/CVE-2023-26451 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2023/Aug/8 · Nota
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json · Aviso do Fabricante
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf · Nota
• https://t.me/cvenotify/67164 · Publicação no Telegram