A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html | Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2024/Jan/3 | Mailing List Third Party Advisory |
| https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json | Issue Tracking |
| https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf | Release Notes |
| http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html | Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2024/Jan/3 | Mailing List Third Party Advisory |
| https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json | Issue Tracking |
| https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf | Release Notes |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html - Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2024/Jan/3 - Mailing List, Third Party Advisory | |
| References | () https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json - Issue Tracking | |
| References | () https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf - Release Notes |
12 Jan 2024, 14:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json - Issue Tracking | |
| References | () https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf - Release Notes | |
| References | () http://seclists.org/fulldisclosure/2024/Jan/3 - Mailing List, Third Party Advisory | |
| References | () http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html - Third Party Advisory, VDB Entry | |
| CWE | CWE-78 | |
| CPE | cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev35:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev07:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev37:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev33:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev06:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev24:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev08:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev28:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev29:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev04:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev27:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev30:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev09:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev02:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev34:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev26:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev01:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev25:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev05:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev03:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev50:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev32:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev36:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:* cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev31:*:*:*:*:*:* |
|
| First Time |
Open-xchange
Open-xchange ox App Suite |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
12 Jan 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
09 Jan 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Jan 2024, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Jan 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-08 09:15
Updated : 2024-11-21 07:56
NVD link : CVE-2023-29048
Mitre link : CVE-2023-29048
CVE.ORG link : CVE-2023-29048
JSON object : View
Products Affected
open-xchange
- ox_app_suite
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')