Vulnerability · Published Jun 20, 2023 · Assigned by OX
CVE-2023-26434
Medium 4.3
In plain English
A medium-severity uncontrolled resource consumption in OX App Suite from OX Software GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Official description
When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted POP3 server response to reasonable length/size. No publicly available exploits are known.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OX Software GmbH | OX App Suite | 0 – through 7.10.6-rev39 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf release-notes
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json vendor-advisory
- http://seclists.org/fulldisclosure/2023/Jun/8
- http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html