Ox Software Gmbh Ox App Suite vulnerabilities

CVE-2023-26455 [HIGH] CWE-287 CVE-2023-26455: RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers wit RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are kno

CVE-2023-26454 [HIGH] CWE-89 CVE-2023-26454: Requests to fetch image metadata could be abused to include SQL queries that would be executed unche Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user a

CVE-2023-29047 [HIGH] CWE-89 CVE-2023-29047: Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing c Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account. None No publicly

CVE-2023-26452 [HIGH] CWE-89 CVE-2023-26452: Requests to cache an image and return its metadata could be abused to include SQL queries that would Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the servic

CVE-2023-26453 [HIGH] CWE-89 CVE-2023-26453: Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account.

CVE-2023-29044 [MEDIUM] CWE-79 CVE-2023-29044: Documents operations could be manipulated to contain invalid data types, possibly script code. Scrip Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get escaped to avoid code execution. No publicly available e

CVE-2023-29046 [MEDIUM] CWE-400 CVE-2023-29046: Connections to external data sources, like e-mail autoconfiguration, were not terminated in case the Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amoun

CVE-2023-29045 [MEDIUM] CWE-79 CVE-2023-29045: Documents operations, in this case "drawing", could be manipulated to contain invalid data types, po Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now gets checked for validity to avoid

CVE-2023-26456 [MEDIUM] CWE-79 CVE-2023-26456: Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficient Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. S

CVE-2023-26443 [CRITICAL] CWE-89 CVE-2023-26443: Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single quotes for SQL FULLTEXT queries. No publicly available e

CVE-2023-26439 [HIGH] CWE-89 CVE-2023-26439: The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently s The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discovering other users cached data. We have improved the input check for API calls and filter for poten

CVE-2023-26440 [HIGH] CWE-89 CVE-2023-26440: The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insuf The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary SQL queries. We have improved the input check for API calls and filter for potentially maliciou

CVE-2023-26451 [HIGH] CWE-330 CVE-2023-26451: Functions with insufficient randomness were used to generate authorization tokens of the integrated Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is

CVE-2023-26441 [MEDIUM] CWE-200 CVE-2023-26441: Cacheservice did not correctly check if relative cache object were pointing to the defined absolute Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access to the database and a local or restricted network would be able to read arbitrary local file system resources that are accessible by the services system user account. We have improved path vali

CVE-2023-26450 [MEDIUM] CWE-79 CVE-2023-26450: The "OX Count" web service did not specify a media-type when processing responses by external resour The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or l

CVE-2023-26449 [MEDIUM] CWE-79 CVE-2023-26449: The "OX Chat" web service did not specify a media-type when processing responses by external resourc The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lu

CVE-2023-26448 [MEDIUM] CWE-79 CVE-2023-26448: Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malici Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the

CVE-2023-26445 [MEDIUM] CWE-79 CVE-2023-26445: Frontend themes are defined by user-controllable jslob settings and could point to a malicious resou Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporar

CVE-2023-26447 [MEDIUM] CWE-79 CVE-2023-26447: The "upsell" widget for the portal allows to specify a product description. This description taken f The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit t

CVE-2023-26430 [MEDIUM] CWE-77 CVE-2023-26430: Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules. We have added sanitization to all mail-filter APIs to avoid