CVE-2023-26451: open-xchange open-xchange_appsuite_backend Use of Insufficiently Random Values

Vulnerability summary

CVE-2023-26451 is a high (CVSS 7.5) Use of Insufficiently Random Values vulnerability in open-xchange open-xchange_appsuite_backend. EPSS estimates a 1.19% chance of exploitation in the next 30 days, higher than 67.5% of scored vulnerabilities.

Timeline

1. 02-08-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.

• CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.