A critical vulnerability in Open-Xchange OX App Suite allows unauthenticated attackers to cause a denial of service through cache exhaustion.

This vulnerability is a case of uncontrolled resource consumption (CWE-400), where an unauthenticated attacker can flood the system with API requests. This action forces the application to fill its cache, causing the eviction of essential data and resulting in the unavailability of the web frontend.

The ability for an unauthenticated remote attacker to trigger a denial of service represents a significant risk to business continuity. With a CVSS score of 7.5, this high-severity flaw can disrupt critical web services, impacting user access and operational productivity. Prolonged downtime resulting from such cache-based attacks may lead to reputational damage and loss of service availability for dependent workflows.

Immediate Action: Update Open-Xchange OX App Suite to the latest version provided by the vendor to address this cache management defect.

Proactive Monitoring: Monitor system logs for unusual spikes in API request volume and track cache hit or miss ratios to identify potential exploitation attempts.

Compensating Controls: Implement rate limiting on API endpoints at the network perimeter or within a Web Application Firewall to restrict the volume of requests from single or suspicious sources.

Public Exploit Available: No (exploit_available: false)

Given the high impact on service availability and the ease of execution, administrators must prioritize the deployment of the provided vendor patches. Ensure that all instances of the OX App Suite are updated to the secure version immediately to prevent potential service disruption by remote, unauthenticated actors.