RCE in Open-xchange Open-xchange_appsuite_backend
CVE-2023-26436
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary co…
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.013 (66.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Open-xchange Open-xchange_appsuite_backend — versions 7.10.6
- Ox Software Gmbh App Suite — versions 0
Weakness classification (CWE)
References
- security@open-xchange.com (release-notes, Release Notes)
- security@open-xchange.com (vendor-advisory)
- security@open-xchange.com (Mailing List, Third Party Advisory)
- security@open-xchange.com (VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-26436?
- CVE-2023-26436 is a high-severity vulnerability in Open-xchange Open-xchange_appsuite_backend, classified under Code Injection. CVSS score: 7.1/10. Published 2023-06-20.
- How severe is CVE-2023-26436?
- High severity. CVSS v3 base score is 7.1 out of 10.