CVE-2023-26432

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted SMTP server response to reasonable length/size. No publicly available exploits are known.

*Credits: N/A

CVSS Scores

NISTv3.1 4.3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-02-22 CVE Reserved
2023-06-20 CVE Published
2024-06-26 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-400: Uncontrolled Resource Consumption

CAPEC

References (4)

URL	Tag	Source
http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html	Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jun/8	Mailing List
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf	Release Notes

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json	2024-01-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Backend Search vendor "Open-xchange" for product "Open-xchange Appsuite Backend"				< 7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite Backend" and version " < 7.10.6"		-		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Backend Search vendor "Open-xchange" for product "Open-xchange Appsuite Backend"				>= 8.0.0 < 8.11.0 Search vendor "Open-xchange" for product "Open-xchange Appsuite Backend" and version " >= 8.0.0 < 8.11.0"		-		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Backend Search vendor "Open-xchange" for product "Open-xchange Appsuite Backend"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite Backend" and version "7.10.6"		-		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Backend Search vendor "Open-xchange" for product "Open-xchange Appsuite Backend"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite Backend" and version "7.10.6"		revision_39		Affected