CVE-2023-26436

Severity CVSS v4.0:

Pending analysis

Type:

CWE-502 Deserialization of Untrusted Dat

Publication date:

20/06/2023

Last modified:

12/01/2024

Description

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processing the request. A check has been introduced to restrict processing of legal and expected classes for this API. We now log a warning in case there are attempts to inject illegal classes. No publicly available exploits are known.<br /> <br />

Impact

Vector 3.x

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 8.80 HIGH
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Adjacent
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

8.80

Severity 3.x

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend::::::::		7.10.6 (excluding)
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:::::::*
cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:7.10.6:revision_39::::::

To consult the complete list of CPE names with products and versions, see this page

CVE-2023-26436

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools