PT-2023-20647 · Unknown · Imageconverter Service

Mdisec + 1 · Publicado 2023-11-02 · Atualizado 2024-01-12 · CVE-2023-26454

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions imageconverter service (affected versions not specified)

Description The issue allows requests to fetch image metadata to be abused, including SQL queries that would be executed unchecked. This requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the service's database user account. API requests are now properly checked for valid content, and attempts to circumvent this check are being logged as an error.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-26454

Produtos afetados

Imageconverter Service

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-26454 · Aviso do Fabricante
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf · Aviso do Fabricante
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-26454 · Nota de Segurança
• https://twitter.com/CVEnew/status/1720068055911514362 · Publicação no Twitter
• https://twitter.com/cracbot/status/1720381881542128071 · Publicação no Twitter