CVE-2024-23193 — Sensitive Information Exposure in OX APP Suite

CWE-200 — Sensitive Information ExposureCWE-384 — Session Fixation3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 65.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Open-xchange OX APP SuiteOpen-xchange Gmbh OX APP Suite
Timeline
PublishedMay 6

Description

E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters. Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-rf3v-2m2g-6xwj: E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account↗2024-05-06
▶
CVEList
CVE-2024-23193: E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account↗2024-05-06
▶
CVE-2024-23193 — Sensitive Information Exposure | cvebase