A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html | Third Party Advisory VDB Entry |
http://seclists.org/fulldisclosure/2024/Jan/3 | Mailing List Third Party Advisory |
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json | Issue Tracking |
https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf | Release Notes |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: OX
Published: 2024-01-08T08:51:31.461Z
Updated: 2024-01-12T07:06:36.093Z
Reserved: 2023-03-30T09:34:25.189Z
Link: CVE-2023-29048
JSON object: View
NVD Information
Status : Analyzed
Published: 2024-01-08T09:15:19.893
Modified: 2024-01-12T14:09:06.640
Link: CVE-2023-29048
JSON object: View
Redhat Information
No data.
CWE