Vulnerability in Open-xchange Open-xchange_appsuite_backend
CVE-2023-26451
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client…
EPSS: 0.010 (58.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@open-xchange.com (release-notes, Release Notes)
- security@open-xchange.com (vendor-advisory)
- security@open-xchange.com (Mailing List, Third Party Advisory)
- security@open-xchange.com (VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-26451?
- CVE-2023-26451 is a high-severity vulnerability in Open-xchange Open-xchange_appsuite_backend, classified under Use of Insufficiently Random Values. CVSS score: 7.5/10. Published 2023-08-02.
- How severe is CVE-2023-26451?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-26451 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.