Open-Xchange の ox app suite におけるセッションの固定化の脆弱性
| Title |
Open-Xchange の ox app suite におけるセッションの固定化の脆弱性
|
| Summary |
Open-Xchange の ox app suite には、セッションの固定化の脆弱性が存在します。
|
| Possible impacts |
情報を取得される可能性があります。 |
| Solution |
ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。 |
| Publication Date |
May 6, 2024, midnight |
| Registration Date |
March 12, 2025, 3:15 p.m. |
| Last Update |
March 12, 2025, 3:15 p.m. |
|
CVSS3.0 : 警告
|
| Score |
5.3
|
| Vector |
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected System
| Open-Xchange |
|
ox app suite 8.22 未満
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
その他
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2025年03月12日]
掲載 |
March 12, 2025, 3:15 p.m. |
NVD Vulnerability Information
CVE-2024-23193
| Summary |
E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters. Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions. No publicly available exploits are known.
|
| Publication Date |
May 6, 2024, 4:15 p.m. |
| Registration Date |
May 6, 2024, 8 p.m. |
| Last Update |
March 6, 2025, 3:25 a.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:* |
|
|
|
8.22 |
Related information, measures and tools
Common Vulnerabilities List