CVE-2023-26433

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted IMAP server response to reasonable length/size. No publicly available exploits are known.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
OX Software GmbH	OX App Suite	<= 7.10.6-rev39; <= 8.10

References

http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Jun/8Mailing List, Third Party Advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdfRelease Notes
http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Jun/8Mailing List, Third Party Advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdfRelease Notes

Timeline

Published: Jun 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264344.3When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access t CVE-2023-264355.0It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers co CVE-2023-264368.8Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during de CVE-2023-264375.3Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: thro CVE-2023-264383.1External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS c CVE-2023-264397.8The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL CVE-2023-26447.8A vulnerability, which was classified as problematic, has been found in DigitalPersona FPSensor 1.0.0.1. This issue affects some unknown pro CVE-2023-264407.8The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be e CVE-2023-264415.5Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An at CVE-2023-264423.2In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attac CVE-2023-264439.8Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this ca CVE-2023-264455.4Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. M