PT-2023-20647 · Unknown · Imageconverter Service

Mdisec + 1 · Published 2023-11-02 · Updated 2024-01-12 · CVE-2023-26454

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions imageconverter service (affected versions not specified)

Description The issue allows requests to fetch image metadata to be abused, including SQL queries that would be executed unchecked. This requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the service's database user account. API requests are now properly checked for valid content, and attempts to circumvent this check are being logged as an error.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-26454

Affected Products

Imageconverter Service

References · 6

• https://osv.dev/vulnerability/CVE-2023-26454 · Vendor Advisory
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf · Vendor Advisory
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26454 · Security Note
• https://twitter.com/CVEnew/status/1720068055911514362 · Twitter Post
• https://twitter.com/cracbot/status/1720381881542128071 · Twitter Post