CVE-2023-26442
Low
Description
In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources. No publicly available exploits are known.
SeverityLow
CVSS3.2
Exploit probability—
ProductOpen-xchange Appsuite Office
PublishedAug 2, 2023
First seenAug 2, 2023
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- open-xchange open-xchange_appsuite_office8.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| open-xchange open-xchange_appsuite_office | v < 8.11 | 8.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.