CVE-2023-26434
MEDIUMopen-xchange_appsuite_backend < 7.10.6 - Denial of Service via POP3 Capabilities Response
Title source: llmDescription
When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted POP3 server response to reasonable length/size. No publicly available exploits are known.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html
Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jun/8
Release Notes release-notes
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf
Vendor Advisory vendor-advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
Scores
CVSS v3
4.3
EPSS
0.0013
EPSS Percentile
32.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Details
CWE
CWE-400
Status
published
Products (2)
open-xchange/open-xchange_appsuite_backend
7.10.6 (2 CPE variants)
open-xchange/open-xchange_appsuite_backend
< 7.10.6
Published
Jun 20, 2023
Tracked Since
Feb 18, 2026