LDAP Injection Vulnerability in Open-Xchange App Suite

CVE-2023-29050

What is CVE-2023-29050?

The LDAP contacts provider in Open-Xchange App Suite contains a vulnerability that may be exploited by users with elevated privileges. This security flaw allows these users to inject LDAP filter strings, which can gain unauthorized access to data beyond the intended access hierarchy, potentially leading to information confidentiality breaches. Moreover, this can escalate to a situation where an excessive load is placed on the LDAP directory server, risking service availability and resulting in denial of service conditions. While mitigations, such as encoding for user-provided fragments used in LDAP query construction, have been implemented, it is critical for organizations using the affected product to ensure robust access controls to prevent potential exploitation.

References