PT-2023-20634 · Unknown · Cacheservice

Mdisec + 1 · Published 2023-08-02 · Updated 2024-01-12 · CVE-2023-26441

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cacheservice (affected versions not specified)

Description The issue arises from the Cacheservice not correctly checking if relative cache objects point to the defined absolute location when accessing resources. This allows an attacker with access to the database and a local or restricted network to read arbitrary local file system resources accessible by the service's system user account. The problem has been addressed by improving path validation to ensure access is contained within the defined root directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

CVE-2023-26441

Affected Products

Cacheservice

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-26441 · Security Note
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26441 · Vendor Advisory
• http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html · Note
• https://t.me/cvenotify/56016 · Telegram Post
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf · Note
• https://t.me/cibsecurity/67576 · Telegram Post
• http://seclists.org/fulldisclosure/2023/Aug/8 · Note