PT-2024-19710 · Open Xchange Gmbh+1 · Ox App Suite

Published 2024-05-06 · Updated 2025-04-10 · CVE-2024-23193

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue arises from E-Mails being exported as PDF and stored in a cache that does not consider specific session information for the related user account. This allows users of the same service node to access other users' E-Mails for a brief moment until caches are cleared, provided they have good timing and modify multiple request parameters. The cache for PDF exports has been updated to take user session information into consideration when performing authorization decisions.

Recommendations Please deploy the provided updates and patch releases to resolve the issue. At the moment, there is no information about a specific version that contains a fix for this vulnerability.

Fix

Information Disclosure

Session Fixation

Weakness Enumeration

CWE-200

CWE-384

Related Identifiers

CVE-2024-23193

Affected Products

Ox App Suite

References · 10

• https://osv.dev/vulnerability/CVE-2024-23193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23193 · Security Note
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json · Vendor Advisory
• http://seclists.org/fulldisclosure/2024/May/3 · Note
• https://documentation.open-xchange.com/appsuite/releases/8.22 · Note
• https://t.me/cvenotify/79330 · Telegram Post
• https://t.me/cvenotify/118712 · Telegram Post
• https://t.me/cvenotify/79204 · Telegram Post
• https://twitter.com/CVEnew/status/1787510816498975052 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1787429967283769835 · Twitter Post