CVE-2023-29050

Katalog CVE

CVSS 9.6 · Critical EPSS 1,7%

Kerentanan Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') pada open-xchange ox app suite. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known.

Rincian

Terbit di NVD

8 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2024/Jan/3 mailing list · advisory pihak ketiga
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json issue tracking
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19... release notes