CVE-2023-26442

LowCVSS 3.2/10Last modified Jun 17, 2026

Description

In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources. No publicly available exploits are known.

Metrics

CVSS 3.1 3.2/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
OX Software GmbH	OX App Suite	<= 8.10

References

http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Aug/8Mailing List, Third Party Advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdfRelease Notes
http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Aug/8Mailing List, Third Party Advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdfRelease Notes

Timeline

Published: Aug 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264439.8Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this ca CVE-2023-264455.4Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. M CVE-2023-264465.4The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed CVE-2023-264475.4The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not ge CVE-2023-264485.4Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script CVE-2023-264495.4The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be execute CVE-2023-26459.8A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Ma CVE-2023-264505.4The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be execut CVE-2023-264517.5Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorizati CVE-2023-264528.8Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this CVE-2023-264538.8Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires a CVE-2023-264548.8Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requ