CVE-2023-26428
Medium
Description
Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could be read even though they are not explicitly shared. We improved permission handling when requesting snippets that are not explicitly shared with other users. No publicly available exploits are known.
SeverityMedium
CVSS6.5
Exploit probability—
ProductOpen-xchange Appsuite Backend
PublishedJun 20, 2023
First seenJun 20, 2023
How to fix
Update
- open-xchange open-xchange_appsuite_backend7.10.6, 8.11.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| open-xchange open-xchange_appsuite_backend | v < 7.10.6, 8.0.0 ≤ v < 8.11.0, 7.10.6 | 7.10.6, 8.11.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.