4.3

CVE-2023-24600

OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book.

Data is provided by the National Vulnerability Database (NVD)
Open-xchange ≫ Ox App Suite Version < 7.10.6
Open-xchange ≫ Ox App Suite Version7.10.6 Update-
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev01
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev02
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev03
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev04
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev05
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev06
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev07
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev08
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev09
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev10
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev11
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev12
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev13
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev14
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev15
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev16
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev17
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev18
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev19
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev20
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev21
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev22
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev23
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev24
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev25
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev26
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev27
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev28
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev29
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev30
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev31
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev32
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev33
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev34
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev35
Open-xchange ≫ Ox App Suite Version7.10.6 Updaterev36
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.04% 0.123
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

http://seclists.org/fulldisclosure/2023/May/3
Third Party Advisory
Mailing List