Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Open-Xchange GmbH Component: Open-xchange Appsuite Office Clear all filters
TI-2023-11590 CVE-2023-26442 · GHSA-h5f9-372r-9xwq

Server-side request forgery in Open-Xchange GmbH OX App Suite

Priority LOW 16

In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend.

CVSS 3.1LOW 3.2 Local No auth No interaction EPSS 0.00356 Published 2023-08-02 No fix listed CWE-918
TI-2023-11589 CVE-2023-26441 · GHSA-xq7r-2vx2-8jgj

Information disclosure in Open-Xchange GmbH OX App Suite

Priority LOW 26

Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources.

CVSS 3.1MEDIUM 5.7 Physical No auth No interaction EPSS 0.00397 Published 2023-08-02 No fix listed CWE-200
TI-2023-11588 CVE-2023-26440 · GHSA-vvf9-x2f5-h29c

SQL injection in Open-Xchange GmbH OX App Suite

Priority LOW 34

The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00412 Published 2023-08-02 No fix listed CWE-89
TI-2023-11587 CVE-2023-26439 · GHSA-h33q-26v7-q343

SQL injection in Open-Xchange GmbH OX App Suite

Priority LOW 34

The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00432 Published 2023-08-02 No fix listed CWE-89