{"api_version":"1","generated_at":"2026-05-01T04:44:38+00:00","cve":"CVE-2023-26451","urls":{"html":"https://cve.report/CVE-2023-26451","api":"https://cve.report/api/cve/CVE-2023-26451.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-26451","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-26451"},"summary":{"title":"CVE-2023-26451","description":"Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.","state":"PUBLIC","assigner":"security@open-xchange.com","published_at":"2023-08-02 13:15:00","updated_at":"2024-01-12 07:15:00"},"problem_types":["CWE-330"],"metrics":[],"references":[{"url":"http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html","name":"http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html","refsource":"MISC","tags":[],"title":"OX App Suite SSRF / SQL Injection / Cross Site Scripting ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json","name":"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json","refsource":"","tags":[],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"404"},{"url":"https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json","name":"https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json","refsource":"MISC","tags":[],"title":"","mime":"application/json","httpstatus":"200","archivestatus":"404"},{"url":"http://seclists.org/fulldisclosure/2023/Aug/8","name":"http://seclists.org/fulldisclosure/2023/Aug/8","refsource":"MISC","tags":[],"title":"Full Disclosure: OXAS-ADV-2023-0003: OX App Suite Security Advisory","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf","name":"https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf","refsource":"MISC","tags":[],"title":"","mime":"application/pdf","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26451","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26451","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"26451","vulnerable":"1","versionEndIncluding":"8.11.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"open-xchange","cpe5":"open-xchange_appsuite_backend","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2023-26451","ASSIGNER":"security@open-xchange.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.\n\n"}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-330 Use of Insufficiently Random Values","cweId":"CWE-330"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"OX Software GmbH","product":{"product_data":[{"product_name":"OX App Suite","version":{"version_data":[{"version_affected":"<=","version_name":"0","version_value":"8.11"}]}}]}}]}},"references":{"reference_data":[{"url":"https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf","refsource":"MISC","name":"https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf"},{"url":"https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json","refsource":"MISC","name":"https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json"},{"url":"http://seclists.org/fulldisclosure/2023/Aug/8","refsource":"MISC","name":"http://seclists.org/fulldisclosure/2023/Aug/8"},{"url":"http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html","refsource":"MISC","name":"http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html"}]},"generator":{"engine":"Vulnogram 0.1.0-dev"},"source":{"defect":["MWB-2102"],"discovery":"EXTERNAL"},"impact":{"cvss":[{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}]}},"nvd":{"publishedDate":"2023-08-02 13:15:00","lastModifiedDate":"2024-01-12 07:15:00","problem_types":["CWE-330"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:open-xchange:open-xchange_appsuite_backend:*:*:*:*:*:*:*:*","versionEndIncluding":"8.11.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}