CVE-2023-26434 — Uncontrolled Resource Consumption in Appsuite Backend
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 67.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 20
Description
When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted POP3 server response to reasonable length/size. No publicly available exploits are known.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 2.8 | Impact: 1.4
Affected Packages2 packages
🔴Vulnerability Details
2CVEList▶
CVE-2023-26434: When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes↗2023-06-20
GHSA▶
GHSA-25mr-w95m-82v7: When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes↗2023-06-20