CVE-2023-26442 — Server-Side Request Forgery in Appsuite Office

CWE-918 — Server-Side Request Forgery3 documents3 sources
Severity
3.2LOWNVD
EPSS
0.0%
top 86.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Open-xchange Appsuite OfficeOX Software Gmbh OX APP Suite
Timeline
PublishedAug 2

Description

In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources…

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:NExploitability: 1.4 | Impact: 1.4

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-h5f9-372r-9xwq: In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend↗2023-08-02
▶
CVEList
CVE-2023-26442: In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend↗2023-08-02
▶
CVE-2023-26442 — Server-Side Request Forgery | cvebase