Description
Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited No publicly available exploits are known.
References (3)
Core 3
Core References
Mailing List
http://seclists.org/fulldisclosure/2024/Feb/10
Release Notes release-notes
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf
Vendor Advisory vendor-advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json
Scores
CVSS v3
6.5
EPSS
0.0022
EPSS Percentile
44.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-400
Status
published
Products (2)
open-xchange/open-xchange_appsuite
7.6.3 (27 CPE variants)
open-xchange/open-xchange_appsuite
7.10.6 (23 CPE variants)
Published
Feb 12, 2024
Tracked Since
Feb 18, 2026