PT-2023-19707 · Open Xchange · Ox App Suite

Tim Coen · Published 2023-05-29 · Updated 2025-01-14 · CVE-2023-24605

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OX App Suite versions prior to 7.10.6-rev37

Description The issue concerns the lack of enforcement of two-factor authentication (2FA) for all endpoints in OX App Suite. Specifically, endpoints such as reading from a drive, reading contact data, and renaming tokens are not properly secured with 2FA. This oversight could potentially allow unauthorized access to sensitive data.

Recommendations For versions prior to 7.10.6-rev37, update to version 7.10.6-rev37 or later to ensure 2FA is enforced for all endpoints. As a temporary workaround, consider restricting access to sensitive endpoints, such as those related to drive access, contact data, and token management, until the update can be applied.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-24605

Affected Products

Ox App Suite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-24605 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24605 · Vendor Advisory
• http://seclists.org/fulldisclosure/2023/May/3 · Note
• https://open-xchange.com · Note
• https://t.me/cvenotify/51316 · Telegram Post