CVE-2023-26427
- State
- Published
- Severity
- 3.2 Low
- Published
- Jun 20, 2023
- Updated
- Aug 2, 2024
- Reserved
- Feb 22, 2023
Description
Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.2 Low | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N | OX |
Weaknesses
- CWE-922 Insecure Storage of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
OX App SuiteOX Software GmbH |
|
References
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdfrelease-notes
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.jsonvendor-advisory
- http://seclists.org/fulldisclosure/2023/Jun/8
- http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.