CVE-2023-29046
mediumpriority · track · 17EPSS 0.005 · 41 %ileEUUSEPSS · scored 2026-10-28
Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
- open-xchange open-xchange appsuite< 7.10.6nvdUScpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*
- open-xchange open-xchange appsuite= 7.10.6nvdUScpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-29046/cnnvd
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.jsoncnnvd
- https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0004.jsoncnnvd
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdfcnnvd
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.jsonenisa_euvd
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdfenisa_euvd
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.jsonnvd
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdfRelease NotesVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan