CVE-2023-26427
Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known.
| Software | From | Fixed in |
|---|---|---|
| open-xchange / open-xchange_appsuite_backend | - | 7.10.6 |
| open-xchange / open-xchange_appsuite_backend | 7.10.6 | 7.10.6.x |
| open-xchange / open-xchange_appsuite_backend | 7.10.6-revision_39 | 7.10.6-revision_39.x |
- http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html
- http://seclists.org/fulldisclosure/2023/Jun/8
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
- https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0002.json
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime