CVE-2023-29047

Severity Score

7.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account. None No publicly available exploits are known.

Los endpoints de la API Imageconverter proporcionaban métodos que no validaban ni sanitizaban correctamente la entrada del cliente, lo que permitía inyectar declaraciones SQL arbitrarias. Un atacante con acceso a la red adyacente y potencialmente credenciales API podría leer y modificar el contenido de la base de datos al que puede acceder la cuenta de usuario SQL de imageconverter. Ninguno No se conocen exploits disponibles públicamente.

*Credits: N/A

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-03-30 CVE Reserved
2023-11-02 CVE Published
2023-11-03 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json	2024-01-12
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf	2024-01-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				< 7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version " < 7.10.6"		-		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		-		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6069		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6073		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6080		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6085		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6093		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6102		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6112		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6121		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6133		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6138		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6141		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6146		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6147		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6148		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6150		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6156		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6161		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6166		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6173		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6176		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6178		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6189		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6194		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6199		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6204		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6205		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6209		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6210		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6214		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6215		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6216		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6218		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6219		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6220		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6227		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6230		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6233		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6235		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6236		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6239		Affected
Open-xchange Search vendor "Open-xchange"		Open-xchange Appsuite Search vendor "Open-xchange" for product "Open-xchange Appsuite"				7.10.6 Search vendor "Open-xchange" for product "Open-xchange Appsuite" and version "7.10.6"		patch_release_6241		Affected