CVE-2023-29052 : Users were able to define disclaimer texts for an upsell shop dialog that would

Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.

Published 2024-01-08 09:15:21

Updated 2024-01-22 11:15:47

Source Open-Xchange

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2023-29052

Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev01
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev01:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev02
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev02:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev03
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev03:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev04
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev04:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev05
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev05:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev06
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev06:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev07
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev07:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev08
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev08:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev09
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev09:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev10
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev11
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev12
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev13
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev14
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev15
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev16
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev17
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev18
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev19
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev20
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev21
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev22
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev23
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev24
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev24:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev25
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev25:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev26
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev26:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev27
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev27:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev28
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev28:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev29
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev29:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev30
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev30:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev34
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev34:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev33
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev33:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev32
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev32:*:*:*:*:*:*
Matching versions
Open-xchange » Ox App Suite » Version: 7.10.6 Update Rev31
cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev31:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-29052

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 20 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-29052

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7	NIST	2024-01-12
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7	Open-Xchange	2024-01-08
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2023-29052

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Assigned by:
- nvd@nist.gov (Primary)
- security@open-xchange.com (Secondary)

References for CVE-2023-29052

https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf

Release Notes

CVEs referencing this url
http://packetstormsecurity.com/files/176422/OX-App-Suite-7.10.6-Access-Control-Cross-Site-Scripting.html

OX App Suite 7.10.6 Access Control / Cross Site Scripting ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url
http://seclists.org/fulldisclosure/2024/Jan/4

Full Disclosure: OXAS-ADV-2023-0006: OX App Suite Security Advisory
Mailing List;Third Party Advisory

CVEs referencing this url
https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0006.json

404 Not Found

CVEs referencing this url
https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json

Issue Tracking

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-29052

Products affected by CVE-2023-29052

Exploit prediction scoring system (EPSS) score for CVE-2023-29052

CVSS scores for CVE-2023-29052

CWE ids for CVE-2023-29052

References for CVE-2023-29052