Read the docs
TI-2023-13496 Aliases CVE-2023-29046GHSA-jcjp-p87g-594h

Uncontrolled resource consumption in Open-Xchange GmbH OX App Suite

Priority LOW 21CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known.

Why it matters now

EPSS 0.00577 47th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Open-Xchange GmbHOX App Suiteup to 7.10.6-rev48; up to 8.11—No fix listedCNA
  • OX App Suite VendorOpen-Xchange GmbH Affected up to 7.10.6-rev48; up to 8.11 Fixed in — No fix listed CNA

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*before 7.10.6VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:-:*:*:*:*:*:*7.10.6VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6069:*:*:*:*:*:*7.10.6 patch_release_6069VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6073:*:*:*:*:*:*7.10.6 patch_release_6073VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6080:*:*:*:*:*:*7.10.6 patch_release_6080VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6085:*:*:*:*:*:*7.10.6 patch_release_6085VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6093:*:*:*:*:*:*7.10.6 patch_release_6093VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6102:*:*:*:*:*:*7.10.6 patch_release_6102VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6112:*:*:*:*:*:*7.10.6 patch_release_6112VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6121:*:*:*:*:*:*7.10.6 patch_release_6121VulnerableOpen-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:* Versions before 7.10.6 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:-:*:*:*:*:*:* Versions 7.10.6 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6069:*:*:*:*:*:* Versions 7.10.6 patch_release_6069 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6073:*:*:*:*:*:* Versions 7.10.6 patch_release_6073 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6080:*:*:*:*:*:* Versions 7.10.6 patch_release_6080 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6085:*:*:*:*:*:* Versions 7.10.6 patch_release_6085 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6093:*:*:*:*:*:* Versions 7.10.6 patch_release_6093 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6102:*:*:*:*:*:* Versions 7.10.6 patch_release_6102 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6112:*:*:*:*:*:* Versions 7.10.6 patch_release_6112 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6121:*:*:*:*:*:* Versions 7.10.6 patch_release_6121 Vulnerable ·Open-Xchange GmbH
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6133:*:*:*:*:*:*7.10.6 patch_release_6133VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6138:*:*:*:*:*:*7.10.6 patch_release_6138VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6141:*:*:*:*:*:*7.10.6 patch_release_6141VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6146:*:*:*:*:*:*7.10.6 patch_release_6146VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6147:*:*:*:*:*:*7.10.6 patch_release_6147VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6148:*:*:*:*:*:*7.10.6 patch_release_6148VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6150:*:*:*:*:*:*7.10.6 patch_release_6150VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6156:*:*:*:*:*:*7.10.6 patch_release_6156VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6161:*:*:*:*:*:*7.10.6 patch_release_6161VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6166:*:*:*:*:*:*7.10.6 patch_release_6166VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6173:*:*:*:*:*:*7.10.6 patch_release_6173VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6176:*:*:*:*:*:*7.10.6 patch_release_6176VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6178:*:*:*:*:*:*7.10.6 patch_release_6178VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6189:*:*:*:*:*:*7.10.6 patch_release_6189VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6194:*:*:*:*:*:*7.10.6 patch_release_6194VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6199:*:*:*:*:*:*7.10.6 patch_release_6199VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6204:*:*:*:*:*:*7.10.6 patch_release_6204VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6205:*:*:*:*:*:*7.10.6 patch_release_6205VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6209:*:*:*:*:*:*7.10.6 patch_release_6209VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6210:*:*:*:*:*:*7.10.6 patch_release_6210VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6214:*:*:*:*:*:*7.10.6 patch_release_6214VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6215:*:*:*:*:*:*7.10.6 patch_release_6215VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6216:*:*:*:*:*:*7.10.6 patch_release_6216VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6218:*:*:*:*:*:*7.10.6 patch_release_6218VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6219:*:*:*:*:*:*7.10.6 patch_release_6219VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6220:*:*:*:*:*:*7.10.6 patch_release_6220VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6227:*:*:*:*:*:*7.10.6 patch_release_6227VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6230:*:*:*:*:*:*7.10.6 patch_release_6230VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6233:*:*:*:*:*:*7.10.6 patch_release_6233VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6235:*:*:*:*:*:*7.10.6 patch_release_6235VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6236:*:*:*:*:*:*7.10.6 patch_release_6236VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6239:*:*:*:*:*:*7.10.6 patch_release_6239VulnerableOpen-Xchange GmbH
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6241:*:*:*:*:*:*7.10.6 patch_release_6241VulnerableOpen-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6133:*:*:*:*:*:* Versions 7.10.6 patch_release_6133 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6138:*:*:*:*:*:* Versions 7.10.6 patch_release_6138 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6141:*:*:*:*:*:* Versions 7.10.6 patch_release_6141 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6146:*:*:*:*:*:* Versions 7.10.6 patch_release_6146 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6147:*:*:*:*:*:* Versions 7.10.6 patch_release_6147 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6148:*:*:*:*:*:* Versions 7.10.6 patch_release_6148 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6150:*:*:*:*:*:* Versions 7.10.6 patch_release_6150 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6156:*:*:*:*:*:* Versions 7.10.6 patch_release_6156 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6161:*:*:*:*:*:* Versions 7.10.6 patch_release_6161 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6166:*:*:*:*:*:* Versions 7.10.6 patch_release_6166 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6173:*:*:*:*:*:* Versions 7.10.6 patch_release_6173 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6176:*:*:*:*:*:* Versions 7.10.6 patch_release_6176 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6178:*:*:*:*:*:* Versions 7.10.6 patch_release_6178 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6189:*:*:*:*:*:* Versions 7.10.6 patch_release_6189 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6194:*:*:*:*:*:* Versions 7.10.6 patch_release_6194 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6199:*:*:*:*:*:* Versions 7.10.6 patch_release_6199 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6204:*:*:*:*:*:* Versions 7.10.6 patch_release_6204 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6205:*:*:*:*:*:* Versions 7.10.6 patch_release_6205 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6209:*:*:*:*:*:* Versions 7.10.6 patch_release_6209 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6210:*:*:*:*:*:* Versions 7.10.6 patch_release_6210 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6214:*:*:*:*:*:* Versions 7.10.6 patch_release_6214 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6215:*:*:*:*:*:* Versions 7.10.6 patch_release_6215 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6216:*:*:*:*:*:* Versions 7.10.6 patch_release_6216 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6218:*:*:*:*:*:* Versions 7.10.6 patch_release_6218 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6219:*:*:*:*:*:* Versions 7.10.6 patch_release_6219 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6220:*:*:*:*:*:* Versions 7.10.6 patch_release_6220 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6227:*:*:*:*:*:* Versions 7.10.6 patch_release_6227 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6230:*:*:*:*:*:* Versions 7.10.6 patch_release_6230 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6233:*:*:*:*:*:* Versions 7.10.6 patch_release_6233 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6235:*:*:*:*:*:* Versions 7.10.6 patch_release_6235 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6236:*:*:*:*:*:* Versions 7.10.6 patch_release_6236 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6239:*:*:*:*:*:* Versions 7.10.6 patch_release_6239 Vulnerable ·Open-Xchange GmbH
  • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6241:*:*:*:*:*:* Versions 7.10.6 patch_release_6241 Vulnerable ·Open-Xchange GmbH

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    OX App Suite — documentation.open-xchange.com/appsuite/security/advisories…

    10 records Highest priority Priority LOW 10 LOW

    Other records, highest priority first

    • TI-2023-11601 SQL injection in Open-Xchange GmbH OX App SuitePriority LOW 38
    • TI-2023-11600 SQL injection in Open-Xchange GmbH OX App SuitePriority LOW 38
    • TI-2023-11599 SQL injection in Open-Xchange GmbH OX App SuitePriority LOW 38
    Show all 10 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29046
  2. 2026-10-03 Alias added: GHSA-jcjp-p87g-594h

References

Advisory 2

  • TI-2022-17394 OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only… CVSS 3.1MEDIUM 5.3
  • TI-2022-17393 OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request… CVSS 3.1MEDIUM 5.3
  • TI-2022-17392 OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location… CVSS 3.1MEDIUM 5.3
  • TI-2022-17391 OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help… CVSS 3.1MEDIUM 6.1
  • TI-2022-17390 OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name. CVSS 3.1MEDIUM 6.1
  • TI-2022-17389 OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages. CVSS 3.1MEDIUM 6.1
See all 156 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences