CVE-2022-43698

Published: Apr 15, 2023Modified: Feb 6, 2025

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.

Affected (31)

Products: Open Xchange: Ox App Suite

1 product

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Open Xchange Ox App Suite	Before 7.10.6
Open Xchange Ox App Suite	Version 7.10.6
Open Xchange Ox App Suite	Version 7.10.6 rev01
Open Xchange Ox App Suite	Version 7.10.6 rev02
Open Xchange Ox App Suite	Version 7.10.6 rev03
Open Xchange Ox App Suite	Version 7.10.6 rev04
Open Xchange Ox App Suite	Version 7.10.6 rev05
Open Xchange Ox App Suite	Version 7.10.6 rev06
Open Xchange Ox App Suite	Version 7.10.6 rev07
Open Xchange Ox App Suite	Version 7.10.6 rev08
Open Xchange Ox App Suite	Version 7.10.6 rev09
Open Xchange Ox App Suite	Version 7.10.6 rev10
Open Xchange Ox App Suite	Version 7.10.6 rev11
Open Xchange Ox App Suite	Version 7.10.6 rev12
Open Xchange Ox App Suite	Version 7.10.6 rev13
Open Xchange Ox App Suite	Version 7.10.6 rev14
Open Xchange Ox App Suite	Version 7.10.6 rev15
Open Xchange Ox App Suite	Version 7.10.6 rev16
Open Xchange Ox App Suite	Version 7.10.6 rev17
Open Xchange Ox App Suite	Version 7.10.6 rev18
Open Xchange Ox App Suite	Version 7.10.6 rev19
Open Xchange Ox App Suite	Version 7.10.6 rev20
Open Xchange Ox App Suite	Version 7.10.6 rev21
Open Xchange Ox App Suite	Version 7.10.6 rev22
Open Xchange Ox App Suite	Version 7.10.6 rev23
Open Xchange Ox App Suite	Version 7.10.6 rev24
Open Xchange Ox App Suite	Version 7.10.6 rev25
Open Xchange Ox App Suite	Version 7.10.6 rev26
Open Xchange Ox App Suite	Version 7.10.6 rev27
Open Xchange Ox App Suite	Version 7.10.6 rev28
Open Xchange Ox App Suite	Version 7.10.6 rev29

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

https://open-xchange.com

Source: cve@mitre.org

Product

https://seclists.org/fulldisclosure/2023/Feb/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://open-xchange.com

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://seclists.org/fulldisclosure/2023/Feb/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.