gsd-2023-26455
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.
Aliases
Aliases
CVE-2023-26455


To clipboard 

{
  "GSD": {
    "alias": "CVE-2023-26455",
    "id": "GSD-2023-26455"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-26455"
      ],
      "details": "RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.\n\n",
      "id": "GSD-2023-26455",
      "modified": "2023-12-13T01:20:54.187348Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@open-xchange.com",
        "ID": "CVE-2023-26455",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "OX App Suite",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "0",
                          "version_value": "7.10.6-rev48"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "OX Software GmbH"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-287",
                "lang": "eng",
                "value": "CWE-287 Improper Authentication"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf",
            "refsource": "MISC",
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf"
          },
          {
            "name": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json",
            "refsource": "MISC",
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json"
          }
        ]
      },
      "source": {
        "defect": [
          "MWB-1996"
        ],
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "59D4F30E-2F52-4948-9C69-C57472833C79",
                    "versionEndExcluding": "7.10.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:-:*:*:*:*:*:*",
                    "matchCriteriaId": "A144D75D-60A8-4EE0-813C-F658C626B2AA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6069:*:*:*:*:*:*",
                    "matchCriteriaId": "2DA66230-DE02-4881-A893-E9E78286B157",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6073:*:*:*:*:*:*",
                    "matchCriteriaId": "955F3DFB-6479-4867-B62A-82730DBEB498",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6080:*:*:*:*:*:*",
                    "matchCriteriaId": "327D1B56-0D05-4D99-91D4-CC1F0AC32972",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6085:*:*:*:*:*:*",
                    "matchCriteriaId": "D0CD0684-C431-47F8-A2F4-1936D5C5A72B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6093:*:*:*:*:*:*",
                    "matchCriteriaId": "EAA6A4A7-C1EE-4716-9F4D-2FF4C4D5FEC8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6102:*:*:*:*:*:*",
                    "matchCriteriaId": "D0968764-CCEE-47A7-9111-E106D887DA43",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6112:*:*:*:*:*:*",
                    "matchCriteriaId": "16589FBB-F0CD-4041-8141-5C89FCCA72AF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6121:*:*:*:*:*:*",
                    "matchCriteriaId": "3CB877EE-A5FE-4FF7-9D21-5C1CFA7343D4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6133:*:*:*:*:*:*",
                    "matchCriteriaId": "0DF5FB90-8D6D-4F99-B454-411B1DFFA630",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6138:*:*:*:*:*:*",
                    "matchCriteriaId": "F58876B9-6C2E-4048-A793-B441A84E86F5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6141:*:*:*:*:*:*",
                    "matchCriteriaId": "D5F177CB-CC45-45A0-9D02-C14A13ECC7A3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6146:*:*:*:*:*:*",
                    "matchCriteriaId": "A89A4192-54E9-4899-8C7B-6C7F7E650D5C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6147:*:*:*:*:*:*",
                    "matchCriteriaId": "F2DC1357-9CD5-415F-A190-2F3F4498EF96",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6148:*:*:*:*:*:*",
                    "matchCriteriaId": "D78ACF64-2802-44DD-AF7A-1BD5EA7F9908",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6150:*:*:*:*:*:*",
                    "matchCriteriaId": "E8F675FA-1684-413A-B1BE-1C5434AC2862",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6156:*:*:*:*:*:*",
                    "matchCriteriaId": "F3F1FDC3-35B2-4BDB-A685-75BC72588179",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6161:*:*:*:*:*:*",
                    "matchCriteriaId": "5B1E509D-2F41-4296-86D2-6BD71783060F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6166:*:*:*:*:*:*",
                    "matchCriteriaId": "AC93EA37-F341-45EC-B651-4F326FB8C613",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6173:*:*:*:*:*:*",
                    "matchCriteriaId": "1A4DB8A6-1702-462C-BFCB-39F91D2EFCE1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6176:*:*:*:*:*:*",
                    "matchCriteriaId": "FC0AEFDB-D033-47FC-93FC-8652F922BB8C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6178:*:*:*:*:*:*",
                    "matchCriteriaId": "B5354768-6527-43C2-B492-A8C14AB4E784",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6189:*:*:*:*:*:*",
                    "matchCriteriaId": "D83F26D1-B8C6-4114-81EC-810DD5412DC8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6194:*:*:*:*:*:*",
                    "matchCriteriaId": "E9EBC010-9963-4636-96F7-A121FCF755A7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6199:*:*:*:*:*:*",
                    "matchCriteriaId": "F626D64B-C301-4CD8-94B4-48689BD3F29C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6204:*:*:*:*:*:*",
                    "matchCriteriaId": "5E32810C-7B35-42F1-BCA5-E10C02BE2215",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6205:*:*:*:*:*:*",
                    "matchCriteriaId": "6539D059-8614-4C26-93C4-C2DDCC5D35E2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6209:*:*:*:*:*:*",
                    "matchCriteriaId": "E359EE75-A2F9-479B-B757-CAE1064AB8F4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6210:*:*:*:*:*:*",
                    "matchCriteriaId": "0BCABDEF-D292-406E-B53C-AFF22484E916",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6214:*:*:*:*:*:*",
                    "matchCriteriaId": "ABE8872C-B1DD-4A45-8EF8-E8C355CA6C54",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6215:*:*:*:*:*:*",
                    "matchCriteriaId": "44B20B83-833A-4C68-8693-365BD046C157",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6216:*:*:*:*:*:*",
                    "matchCriteriaId": "E254E6D1-D18E-4A2A-A2FF-7D03F39E65DD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6218:*:*:*:*:*:*",
                    "matchCriteriaId": "5F0C5E53-4D15-425A-B4CF-5869353724BF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6219:*:*:*:*:*:*",
                    "matchCriteriaId": "2F4BF5F1-F316-4BAC-83E0-DEAC8C50754E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6220:*:*:*:*:*:*",
                    "matchCriteriaId": "5CDD03A8-5B86-4B87-9C29-6C967261C5C0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6227:*:*:*:*:*:*",
                    "matchCriteriaId": "6071E15F-4D59-41DC-A4D4-7D1AA392A1F2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6230:*:*:*:*:*:*",
                    "matchCriteriaId": "C72C1CEB-7BF7-4A5F-B2E9-397F86CCBF4E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6233:*:*:*:*:*:*",
                    "matchCriteriaId": "5B0F0218-4224-4084-B38D-9719D3782C03",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6235:*:*:*:*:*:*",
                    "matchCriteriaId": "BFC41329-1AD6-4575-A22D-977EC5539DA4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6236:*:*:*:*:*:*",
                    "matchCriteriaId": "217A06B7-0823-4508-BC0C-AD792BA88F7B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6239:*:*:*:*:*:*",
                    "matchCriteriaId": "246E98B2-A6C8-4410-AA6A-7E81EE8C5E76",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6241:*:*:*:*:*:*",
                    "matchCriteriaId": "74D1EC02-D009-45DA-B1EC-2219E0F0183C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.\n\n"
          },
          {
            "lang": "es",
            "value": "RMI no requer\u00eda autenticaci\u00f3n al llamar a ChronosRMIService:setEventOrganizer. Los atacantes con acceso a la red local o adyacente podr\u00edan abusar del servicio RMI para modificar elementos del calendario utilizando RMI. El acceso RMI est\u00e1 restringido a localhost de forma predeterminada. La interfaz se ha actualizada para requerir solicitudes autenticadas. No se conocen exploits disponibles p\u00fablicamente."
          }
        ],
        "id": "CVE-2023-26455",
        "lastModified": "2024-01-12T08:15:42.813",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 5.6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 4.7,
              "source": "security@open-xchange.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2023-11-02T14:15:10.873",
        "references": [
          {
            "source": "security@open-xchange.com",
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json"
          },
          {
            "source": "security@open-xchange.com",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf"
          }
        ],
        "sourceIdentifier": "security@open-xchange.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "security@open-xchange.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.