Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

CVE-2023-26442

Gravedad CVSS v3.1:
BAJA
Tipo:
CWE-918 Falsificación de solicitud en servidor (SSRF)
Fecha de publicación:
02/08/2023
Última modificación:
12/01/2024

Descripción

*** Pendiente de traducción *** In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources. No publicly available exploits are known.<br /> <br />

Productos y versiones vulnerables

CPE Desde Hasta
cpe:2.3:a:open-xchange:open-xchange_appsuite_office:*:*:*:*:*:*:*:* 8.11 (excluyendo)