PT-2023-20644 · Softwarex · Softwarex

Eldar Zeynalli + 1 · Published 2023-08-02 · Updated 2024-01-12 · CVE-2023-26451

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SoftwareX (affected versions not specified)

Description The issue is related to the integrated oAuth Authorization Service, where functions with insufficient randomness were used to generate authorization tokens. This made authorization codes predictable for third parties, allowing them to intercept and take over the client authorization process, potentially compromising other users' accounts. The oAuth Authorization Service is not enabled by default. The implementation has been updated to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2023-26451

Affected Products

Softwarex

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-26451 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26451 · Vendor Advisory
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json · Vendor Advisory
• https://t.me/cibsecurity/67588 · Telegram Post
• http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html · Note
• http://seclists.org/fulldisclosure/2023/Aug/8 · Note
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf · Note
• https://t.me/cvenotify/67164 · Telegram Post