← Vulnerability feed

Vulnerability record · CVE-2023-26436 · published 20 June 2023

CVE-2023-26436: Open-xchange appsuite backend code injection vulnerability

Open Xchange · Open Xchange Appsuite Backend

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processing the request. A check has been introduced to restrict processing of legal and expected classes for this API. We now log a warning in case there are attempts to inject illegal classes. No publicly available exploits are known.

8.8 CVSS 3.1 High EPSS 1.3% · top 31.0% CWE-94 · Code injectionCWE-502 · Deserialization of untrusted data
8.8CVSS 3.1 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processing the request. A check has been introduced to restrict processing of legal and expected classes for this API. We now log a warning in case there are attempts to inject illegal classes. No publicly available exploits are known.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html Third Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2023/Jun/8 Mailing ListThird Party Advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf Release Notes
http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html Third Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2023/Jun/8 Mailing ListThird Party Advisory
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf Release Notes

Track CVE-2023-26436 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-26443Open-xchange appsuite backend sql injection vulnerabilityFull-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abus…EPSS 0.82%7.5CVE-2023-26451Open-xchange appsuite backend vulnerabilityFunctions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes …EPSS 1.2%6.5CVE-2023-26428Open-xchange appsuite backend insecure direct object reference vulnerabilityAttackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other use…EPSS 0.98%6.1CVE-2016-6846Open-xchange documentconverter-api cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8;…EPSS 1.2%5.3CVE-2023-26429Open-xchange appsuite backend command injection vulnerabilityControl characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and …EPSS 0.79%5.0CVE-2023-26435Open-xchange appsuite backend server-side request forgery (ssrf) vulnerabilityIt was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could disco…EPSS 0.78%4.3CVE-2023-26430Open-xchange appsuite backend command injection vulnerabilityAttackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE exten…EPSS 0.75%4.3CVE-2023-26433Open-xchange appsuite backend uncontrolled resource consumption vulnerabilityWhen adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2023-26436), CISA KEV, FIRST EPSS (scores of 2026-10-17). This page is refreshed as NVD updates the record.