Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') (CWE-90)
The optional "LDAP contacts provider" in Open-Xchange OX App Suite could be abused by privileged users to inject LDAP filter strings that allow access to content outside of the intended hierarchy. This vulnerability affects unauthorized users' ability to break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service.
This vulnerability has a high severity with a CVSS v3.1 base score of 9.6. It allows unauthorized users to access confidential information outside the intended hierarchy in the LDAP directory. Additionally, it could potentially cause high load on the directory server, leading to denial of service. The vulnerability affects the confidentiality and availability of the system, with no impact on integrity.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Encoding has been added for user-provided fragments that are used when constructing the LDAP query. The vulnerability affects OX App Suite versions prior to 7.10.6 and version 8.16. Users should update to a patched version.
1. Update OX App Suite to the latest patched version. 2. Implement strong access controls and least privilege principles for users with access to the LDAP contacts provider. 3. Monitor and log LDAP queries for suspicious activity. 4. Implement input validation and sanitization for user-provided data used in LDAP queries. 5. Consider implementing additional security measures such as query rate limiting to prevent potential denial of service attacks.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
NVD published the first details for CVE-2023-29050
Feedly found the first article mentioning CVE-2023-29050. See article
EPSS Score was set to: 0.05% (Percentile: 12.2%)
A CVSS base score of 9.6 has been assigned.