Skip to content
CVE PROGRAM SOURCE RECORD3.5 Low

CVE-2023-26430

Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by Ap

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OX

Description

Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules. We have added sanitization to all mail-filter APIs to avoid forwardning control characters to subsystems. No publicly available exploits are known.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OX Software GmbH OX App Suite

Default version status: unaffected

  • 0 to ≤ 7.10.6-rev42affected
  • 0 to ≤ 8.10affected

References