4.2

CVE-2023-24605

OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Open-xchange ≫ Ox App Suite Version < 7.10.6
Open-xchange ≫ Ox App Suite Version 7.10.6 Update -
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev01
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev02
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev03
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev04
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev05
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev06
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev07
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev08
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev09
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev10
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev11
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev12
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev13
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev14
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev15
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev16
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev17
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev18
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev19
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev20
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev21
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev22
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev23
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev24
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev25
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev26
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev27
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev28
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev29
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev30
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev31
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev32
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev33
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev34
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev35
Open-xchange ≫ Ox App Suite Version 7.10.6 Update rev36
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.273
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.2 1.6 2.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CISA-ADP 4.2 1.6 2.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://open-xchange.com
Product
http://seclists.org/fulldisclosure/2023/May/3
Third Party Advisory
Mailing List