Vulnerability · Published Nov 2, 2023 · Assigned by OX

CVE-2023-26455

Medium 5.6

In plain English

A medium-severity improper authentication in OX App Suite from OX Software GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)0.2%top 90.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.

Affected products (as reported)

Vendor	Product	Versions
OX Software GmbH	OX App Suite	0 – through 7.10.6-rev480 – through 8.12

Weakness: CWE-287 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

In plain English

Official description

Affected products (as reported)

References