PT-2023-20628 · Ox Software Gmbh+1 · Ox App Suite+1

Mdisec · Published 2023-06-20 · Updated 2026-04-05 · CVE-2023-26431

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue arises from the code not recognizing IPv4-mapped IPv6 addresses as "local", leading to a connection attempt. This could be exploited by attackers with user account access to bypass deny-list functionality, allowing them to gain insights into network topology and running services by triggering requests to restricted infrastructure. The code now respects possible IPv4-mapped IPv6 addresses when checking deny-lists.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-26431

Affected Products

Ox App Suite

Open-Xchange Appsuite Backend

References · 9

• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26431 · Security Note
• https://t.me/cvenotify/52855 · Telegram Post
• https://t.me/cvenotify/67178 · Telegram Post
• http://seclists.org/fulldisclosure/2023/Jun/8 · Note
• http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html · Note
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf · Note
• https://twitter.com/dailycve/status/2040715868171059387 · Twitter Post