CVE-2023-26440 Vulnerability Details

  /     /     /  

CVE-2023-26440 Metadata Quick Info

CVE Published: 02/08/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: OX | Vendor: OX Software GmbH | Product: OX App Suite
Status : PUBLISHED

---

CVE-2023-26440 Description

The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary SQL queries. We have improved the input check for API calls and filter for potentially malicious content. No publicly available exploits are known.

Metrics

CVSS Version: 3.1 | Base Score: 7.1 HIGH
Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* PHYSICAL
    Attack Complexity (AC)* HIGH
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* CHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-89
CWE Name: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ( SQL Injection )
Source: OX Software GmbH

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).