Open-Xchange OX App Suite up to 7.10.6-rev50/8.16 LDAP Contacts Provider ldap injection

Summaryinfo

A vulnerability described as critical has been identified in Open-Xchange OX App Suite up to 7.10.6-rev50/8.16. This affects an unknown function of the component LDAP Contacts Provider. Such manipulation leads to ldap injection. This vulnerability is traded as CVE-2023-29050. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Open-Xchange OX App Suite up to 7.10.6-rev50/8.16. It has been rated as critical. Affected by this issue is an unknown code block of the component LDAP Contacts Provider. The manipulation with an unknown input leads to a ldap injection vulnerability. Using CWE to declare the problem leads to CWE-90. The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component. Impacted is confidentiality, and availability. CVE summarizes:

The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known.

The weakness was shared 01/08/2024 as oxas-adv-2023-0005. The advisory is shared for download at documentation.open-xchange.com. This vulnerability is handled as CVE-2023-29050 since 03/30/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1505.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Open-Xchange

Name

• OX App Suite

Version

• 7.10.6-rev50
• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6
• 8.7
• 8.8
• 8.9
• 8.10
• 8.11
• 8.12
• 8.13
• 8.14
• 8.15
• 8.16

License

• open-source

Website

• Vendor: https://www.open-xchange.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion