PT-2023-20625 · Ox Software Gmbh+1 · Ox App Suite+1

Foobar7 + 1 · Published 2023-06-20 · Updated 2024-01-12 · CVE-2023-26429

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue arises from control characters not being removed when exporting user feedback content, allowing attackers to include unexpected content and potentially break the exported data structure. This is mitigated by dropping all control characters that are not whitespace characters during the export. No publicly available exploits are known.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-26429

Affected Products

Ox App Suite

Open-Xchange Appsuite Backend

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-26429 · Security Note
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26429 · Vendor Advisory
• http://seclists.org/fulldisclosure/2023/Jun/8 · Note
• https://t.me/cvenotify/52856 · Telegram Post
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf · Note
• https://t.me/cvenotify/52874 · Telegram Post
• https://t.me/cvenotify/67177 · Telegram Post
• http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html · Note