CVE-2023-26432: When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a...
4.3
CVSS
Description
When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted SMTP server response to reasonable length/size. No publicly available exploits are known.
Classification
CVE ID: CVE-2023-26432
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.3
Affected Products
Vendor: OX Software GmbH
Product: OX App Suite
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.17% (probability of being exploited)
EPSS Percentile: 54.97% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdfhttps://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
http://seclists.org/fulldisclosure/2023/Jun/8
http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html