CVE-2023-26455 : RMI was not requiring authentication when calling ChronosRMIService:setEventOrga

RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.

Published 2023-11-02 14:15:11

Updated 2024-01-12 08:15:43

Source Open-Xchange

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2023-26455

Open-xchange » Open-xchange Appsuite
Versions before (<) 7.10.6
cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:-:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6069
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6069:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6073
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6073:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6080
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6080:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6085
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6085:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6093
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6093:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6102
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6102:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6112
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6112:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6121
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6121:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6133
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6133:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6138
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6138:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6141
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6141:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6146
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6146:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6147
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6147:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6148
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6148:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6150
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6150:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6156
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6156:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6161
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6161:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6166
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6166:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6173
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6173:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6176
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6176:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6178
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6178:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6189
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6189:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6194
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6194:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6199
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6199:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6205
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6205:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6204
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6204:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6209
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6209:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6210
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6210:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6214
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6214:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6215
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6215:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6216
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6216:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6218
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6218:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6219
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6219:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6220
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6220:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6227
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6227:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6230
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6230:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6233
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6233:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6235
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6235:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6236
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6236:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6239
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6239:*:*:*:*:*:*
Matching versions
Open-xchange » Open-xchange Appsuite » Version: 7.10.6 Update Patch Release 6241
cpe:2.3:a:open-xchange:open-xchange_appsuite:7.10.6:patch_release_6241:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-26455

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-26455

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
5.6	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L	0.8	4.7	Open-Xchange
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: High Availability: Low

CWE ids for CVE-2023-26455

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Assigned by:
- nvd@nist.gov (Primary)
- security@open-xchange.com (Secondary)

References for CVE-2023-26455

Jump to

Vulnerability Details : CVE-2023-26455

Products affected by CVE-2023-26455

Exploit prediction scoring system (EPSS) score for CVE-2023-26455

CVSS scores for CVE-2023-26455

CWE ids for CVE-2023-26455

References for CVE-2023-26455